Visualize the devices in the defined machinegroups
Visualization Defender Machine Groups
Query
DeviceInfo
| summarize dcount(DeviceName) by MachineGroup
| sort by dcount_DeviceName
| render columnchart with(title="Total Devices by MachineGroup")About this query
Visualize the devices in the defined machinegroups
In order to get results the device groups need to be defined: MS Documentation
Defender XDR
Sentinel
DeviceInfo
| summarize dcount(DeviceName) by MachineGroup
| sort by dcount_DeviceName
| render columnchart with(title="Total Devices by MachineGroup")
Explanation
This query is designed to create a visual representation of the number of devices within specific machine groups. Here's a simple breakdown of what the query does:
-
Data Source: It starts by accessing the
DeviceInfotable, which contains information about various devices. -
Summarization: The query counts the distinct number of devices (
dcount(DeviceName)) for each machine group (MachineGroup). This helps in understanding how many unique devices are present in each group. -
Sorting: The results are then sorted by the count of devices in descending order. This means the machine group with the most devices will appear first.
-
Visualization: Finally, the data is rendered as a column chart with the title "Total Devices by MachineGroup". This visual makes it easy to compare the number of devices across different machine groups at a glance.
The query is the same for both Defender XDR and Sentinel, indicating that both systems use a similar approach to visualize device distribution across machine groups.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators