Active Incidents
Query
SecurityIncident
| where TimeGenerated > ago(10d)
| where Status == "Active"Explanation
The query is looking for active security incidents that have occurred within the last 10 days.
Details
Rod Trent
Released: June 9, 2020
Tables
SecurityIncident
Keywords
SecurityIncidentTimeGeneratedStatusActive
Operators
|where>ago()==