Visualize the daily events for each table
Visualization Daily Table Events
Query
let TimeRange = 10d;
search *
| where Timestamp > ago(TimeRange)
| project Timestamp, $table
| summarize Events = count() by $table, bin(Timestamp, 1d)
| render linechart with (title="Total Daily Events")About this query
Visualize the daily events for each table
Query Information
Description
In MDE or Sentinel there are plenty of tables that generate logs, in order to determine which tables ingest the most logs the queries below can be used. The TimeRange variable can be used to select the timerange for your visualization.
Mainly important for Sentinel users is to get insight into the amount of traffic ingested, this query can help you to determine which tables ingest most data. The reference below can be used to get more information about cost management in Sentinel.
References
Defender XDR
Sentinel
let TimeRange = 10d;
search *
| where Timestamp > ago(TimeRange)
| project Timestamp, $table
| summarize Events = count() by $table, bin(Timestamp, 1d)
| render columnchart with (title="Total Daily Events", kind=stacked)
Explanation
This query is designed to help users of Microsoft Defender for Endpoint (MDE) or Microsoft Sentinel understand which tables are generating the most log data over a specified period. Here's a simple breakdown of what each part of the query does:
-
TimeRange Variable: The query uses a variable called
TimeRangeset to 10 days (10d). This means the query will look at data from the last 10 days. -
Search and Filter: The query searches through all logs and filters them to only include entries from the last 10 days.
-
Project Relevant Data: It selects two pieces of information from each log entry: the timestamp of the event and the name of the table where the log is stored.
-
Summarize Events: It counts the number of events (logs) for each table, grouping the counts by day. This helps identify which tables are generating the most logs each day.
-
Visualize the Data:
- For Defender XDR, the results are displayed as a line chart, showing the total number of daily events for each table over the specified time range.
- For Sentinel, the results are displayed as a stacked column chart, which also shows the total number of daily events for each table.
This visualization helps users quickly identify which tables are ingesting the most data, which can be important for managing costs and understanding data flow in Microsoft Sentinel.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators