User Risk Visualization last 90 days
Visualization User Risk Events
Query
AADUserRiskEvents
| where TimeGenerated > ago(90d)
| summarize count() by bin(TimeGenerated, 1d), RiskEventType
| render columnchartAbout this query
User Risk Visualization last 90 days
Query Information
Description
This visualization list the User Risk Events that have triggered in the last 90 days. The count per day is classified by the RiskEventType, those can amongs others be:
- AnonymizedIPAddress
- NewCountry
- UnfamliliarFeatures
This visualization can give insight in the amount of risky events that have happened.
References
Sentinel
Explanation
This query is designed to visualize user risk events that have occurred over the past 90 days. It focuses on identifying and counting different types of risk events, such as "AnonymizedIPAddress," "NewCountry," and "UnfamiliarFeatures," among others. The query processes data from the AADUserRiskEvents table, filtering for events generated within the last 90 days. It then groups these events by day and by the type of risk event, counting how many of each type occurred each day. Finally, it displays this information as a column chart, providing a visual representation of the frequency and types of risky user events over time.
Details
Bert-Jan Pals
Released: November 17, 2023
Tables
Keywords
Operators