Query

let TimeFrame = 30d
union *
| where TimeGenerated > startofday(ago(TimeFrame))
| summarize TotalEvents = count() by Type
| sort by TotalEvents asc

About this query

Total Events by Table

Query Information

Description

This query returns a table that shows the number of events for each data table that occurred in the last 30 days. This can returns information about the totalevens in all your Sentinel tables. Since you probably ingest more in Sentinel than you know, this query can result in discovering 'new' data sources to investigate.

Sentinel

Explanation

This query is designed to provide a summary of the number of events recorded in each data table within the last 30 days. Here's a simple breakdown of what it does:

Time Frame: It looks at data from the past 30 days.
Data Collection: It combines data from all available tables.
Filtering: It only considers events that have occurred since the start of the day, 30 days ago.
Counting Events: It counts the total number of events for each table type.
Sorting: It organizes the results in ascending order based on the total number of events.

The purpose of this query is to help you identify how many events are being logged in each table, which can also reveal new data sources that you might not have been aware of in your Sentinel environment.

KQL Search