Query Details

ASR Top Files

Query

DeviceEvents
| where ActionType startswith 'Asr'
//     or ActionType startswith 'ControlledFolderAccessViolation'
    and ActionType endswith 'Audited'
| summarize Count = count() by ActionType, FileName, FolderPath
| sort by Count

Explanation

This query is looking at a dataset called DeviceEvents. It filters the data to only include actions that start with 'Asr' and end with 'Audited'. It then groups the data by ActionType, FileName, and FolderPath, and calculates the count of occurrences for each group. Finally, it sorts the results by the count in ascending order.