Query

ThreatIntelligenceIndicator
| where TimeGenerated > ago(30d)
| extend IOC = iff(isnotempty(DomainName), DomainName, iff(isnotempty(NetworkIP), NetworkIP, iff(isnotempty(Url),Url, "No IOC defined")))
| summarize count() by IOC
| render piechart with (title="Threat Intelligence Indicators by IOC last month")

About this query

Visualize the Threat Intelligence Indicators last 30 days

Query Information

Description

This query visualizes the IOCs that have triggerd in the last 30 days. That can for example be Domains, IPs or URLs. THe resuls are rendered in a Piechart.

Sentinel

Explanation

This query is designed to visualize threat intelligence indicators from the past 30 days. It focuses on identifying and counting different types of Indicators of Compromise (IOCs) such as Domains, IPs, or URLs that have been triggered during this period. The results are displayed in a pie chart, providing a clear visual representation of the distribution of these IOCs over the last month. Here's a breakdown of the query:

Data Source: It uses the ThreatIntelligenceIndicator table.
Time Filter: It filters the data to include only entries from the last 30 days.
IOC Identification: It checks for non-empty values in the DomainName, NetworkIP, and Url fields to determine the type of IOC. If none of these fields have data, it labels the entry as "No IOC defined."
Data Aggregation: It counts the occurrences of each IOC.
Visualization: The results are rendered in a pie chart titled "Threat Intelligence Indicators by IOC last month," showing the proportion of each type of IOC detected.

KQL Search