KQL Search

Query Details

Audit Show Operation Name And Operation Count

Query

// Show OperationName and OperationCount
// See here: https://github.com/rod-trent/SentinelKQL/blob/master/IntuneActivityTypes.txt
IntuneAuditLogs
| summarize OperationCount=count() by OperationName 
| sort by OperationNumberdesc

Explanation

This query is designed to analyze Intune Audit Logs. It counts the number of each type of operation (OperationName) that has occurred, summarizing the total count for each operation. After summarizing, it sorts the results in descending order based on the operation count (OperationNumberdesc).

Details

Ugur Koc profile picture

Ugur Koc

Released: June 25, 2022

Tables

IntuneAuditLogs

Keywords

OperationNameOperationCountIntuneAuditLogs

Operators

IntuneAuditLogssummarizecountbysort by

Actions

GitHub