GraphAPI Resource Request Statistics
Graph API Audit Events Graph Resource API Request Stats
Query
GraphAPIAuditEvents
| extend ParsedUri = tostring(parse_url(RequestUri).Path)
// Normalize Data
| extend GraphAPIPath = tolower(replace_string(ParsedUri, "//", "/"))
// Extract
| extend GraphAPIResource = tostring(split(GraphAPIPath, "/")[2])
| summarize TotalRequest = count() by GraphAPIResource
| sort by TotalRequestAbout this query
Explanation
This query is designed to analyze and summarize the usage of different resources accessed through the Microsoft Graph API by examining the request URLs. Here's a simple breakdown of what the query does:
-
Data Source: It starts by looking at the
GraphAPIAuditEventstable, which contains logs of requests made to the Microsoft Graph API. -
Parse the URL: It extracts the path part of the
RequestUriusing theparse_urlfunction and stores it in a new column calledParsedUri. -
Normalize the Path: It converts the
ParsedUrito lowercase and ensures there are no double slashes, storing the result inGraphAPIPath. -
Extract Resource Type: It splits the
GraphAPIPathby the "/" character and selects the third element (index 2) to identify the specific resource being accessed (e.g., "users", "security", "identity"). This is stored in a new column calledGraphAPIResource. -
Count Requests: It counts how many times each resource type is requested, summarizing this information in a column called
TotalRequest. -
Sort Results: Finally, it sorts the results by the total number of requests for each resource type, allowing you to see which resources are accessed most frequently.
In summary, this query helps you understand which resources in the Microsoft Graph API are being accessed most often by analyzing the request logs.
Details
Bert-Jan Pals
Released: August 14, 2025
Tables
Keywords
Operators