Active Incidents
Query
SecurityIncident
| where TimeGenerated > ago(10d)
| where Status == "Active"Explanation
The query is looking for active security incidents that have occurred within the last 10 days.
Query Details
SecurityIncident
| where TimeGenerated > ago(10d)
| where Status == "Active"The query is looking for active security incidents that have occurred within the last 10 days.