KQL Search

This query is designed to monitor and analyze the distribution of signed versus unsigned drivers in a Windows environment. Here's a simple breakdown of what it does:

1. Data Source: It starts by accessing the WindowsDriver table, which contains information about drivers installed on Windows systems.

2. Summarization: The query uses the summarize operator to aggregate data. It counts the total number of drivers and groups them based on whether they are signed or unsigned.

3. Output: The result will show two columns: one for the Signed status (indicating whether a driver is signed or not) and another for the Count, which shows the number of drivers in each category.

In essence, this query provides a simple count of how many drivers are signed versus unsigned in the Windows environment being monitored.