Query

MicrosoftGraphActivityLogs
| extend ParsedUri = tostring(parse_url(RequestUri).Path)
| summarize TotalRequest = count() by ParsedUri
| sort by TotalRequest

About this query

GraphAPI URI Request Statistics

Query Information

Description

Retrieving request statistics gives us the opportunity for new use cases. One can now summarize all the GraphAPI request types easily with the following query. The unique deltatokens have been removed from the data, returning a better overview of the executed requests.

References

https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview#what-data-is-available-in-the-microsoft-graph-activity-logs

Sentinel

Explanation

This query is designed to analyze and summarize the types of requests made to the Microsoft Graph API by examining the activity logs. Here's a simple breakdown of what the query does:

Data Source: It uses the MicrosoftGraphActivityLogs table, which contains logs of activities related to the Microsoft Graph API.
Extracting URI Path: The query extracts the path component from the RequestUri field of each log entry. This is done using the parse_url function, which helps in isolating the specific part of the URI that indicates the type of request.
Counting Requests: It then counts the total number of requests for each unique URI path. This gives an overview of how many times each type of request was made.
Sorting: Finally, the results are sorted by the total number of requests in ascending order, which means the least frequent requests will appear first.

Overall, this query provides a summary of the different types of requests made to the Microsoft Graph API, excluding any unique delta tokens, which helps in understanding the usage patterns and potentially identifying new use cases.

KQL Search