Incidents By Status Last 24 Hours
Query
SecurityIncident
| summarize arg_max(LastModifiedTime, Status) by IncidentName
| summarize Count = count() by StatusExplanation
This query is counting the number of security incidents based on their status. It first finds the latest status for each incident and then counts the number of incidents for each status.