GraphAPI Resource Request Statistics
Graph Resource API Request Stats
Query
MicrosoftGraphActivityLogs
| extend ParsedUri = tostring(parse_url(RequestUri).Path)
// Normalize Data
| extend GraphAPIPath = tolower(replace_string(ParsedUri, "//", "/"))
// Extract
| extend GraphAPIResource = tostring(split(GraphAPIPath, "/")[2])
| summarize TotalRequest = count() by GraphAPIResource
| sort by TotalRequestAbout this query
Explanation
This KQL query is designed to analyze and summarize the usage of different resources accessed via the Microsoft Graph API. Here's a simple breakdown of what the query does:
-
Data Source: It starts by accessing the
MicrosoftGraphActivityLogs, which contains logs of requests made to the Microsoft Graph API. -
Extracting the Path: It extracts the path part of the
RequestUriusing theparse_urlfunction. This path indicates which specific resource or endpoint was accessed. -
Normalizing the Path: The path is then normalized by converting it to lowercase and ensuring consistent formatting (removing any double slashes).
-
Identifying the Resource: The query splits the normalized path into parts using the slash (
/) as a delimiter. It then selects the third element of this split path, which corresponds to the specific resource type being accessed (e.g., "users", "security", "identity"). -
Counting Requests: It counts how many times each resource type is requested by summarizing the data based on the extracted resource type.
-
Sorting: Finally, it sorts the results by the total number of requests for each resource type, allowing you to see which resources are most frequently accessed.
In essence, this query helps you understand which parts of the Microsoft Graph API are being used the most by analyzing the request logs and summarizing the data by resource type.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators