Query

DeviceNetworkEvents
| where RemoteUrl has "kqlquery.com"
| summarize TotalDevices = dcount(DeviceId) by bin(Timestamp, 1d)
| render columnchart with(title="kqlquery.com visits", xtitle="Date", ytitle="TotalDevices")

About this query

KQLQuery Visits

Query Information

Description

Visualize the visits to KQLQuery.com in a columnchart.

References

https://www.KQLQuery.com/

Defender XDR

Sentinel

DeviceNetworkEvents
| where RemoteUrl has "kqlquery.com"
| summarize TotalDevices = dcount(DeviceId) by bin(TimeGenerated, 1d)
| render columnchart with(title="kqlquery.com visits", xtitle="Date", ytitle="TotalDevices")

Explanation

This query is designed to visualize the number of unique devices visiting the website "kqlquery.com" each day. It does this by:

Filtering network events to only include those where the remote URL contains "kqlquery.com".
Counting the distinct number of devices (using their DeviceId) that accessed the site each day.
Displaying the results in a column chart, where the x-axis represents the date and the y-axis represents the total number of unique devices.

The query is written for two different platforms, Defender XDR and Sentinel, with a slight difference in the timestamp field used for binning the data by day (Timestamp for Defender XDR and TimeGenerated for Sentinel).

KQL Search

KQL Query Visits