Bert-Jan Pals unknown stable kql

Antivirus Detections by day

This query visualizes the daily antivirus detections, which can give an indication in anomalous amount of activities that are performed in your environment.

View Source

Detection Logic

DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == 'AntivirusDetection'
| summarize count() by bin(TimeGenerated, 1d)
| render linechart with(title="Antivirus Detections by Day")

Field Validations

Loading…

Comments (0)

Loading comments...