KQL Search

Query Details

Intune Audit Events

Query

IntuneAuditLogs 
|summarize Auditevents = count() by OperationName 
| sort by Auditevents

Explanation

The query is counting the number of audit events in the IntuneAuditLogs table and grouping them by the OperationName. The results are then sorted by the number of audit events.

Details

Rod Trent

Released: June 29, 2020

Tables

IntuneAuditLogs

Keywords

IntuneAuditLogsAuditeventsOperationName

Operators

summarizecount()bysort by

Actions

GitHub