Query Details
Audit Show Operation Name And Operation Count
Query
// Show OperationName and OperationCount // See here: https://github.com/rod-trent/SentinelKQL/blob/master/IntuneActivityTypes.txt IntuneAuditLogs | summarize OperationCount=count() by OperationName | sort by OperationNumberdesc
Explanation
This query is designed to analyze Intune Audit Logs. It counts the number of each type of operation (OperationName) that has occurred, summarizing the total count for each operation. After summarizing, it sorts the results in descending order based on the operation count (OperationNumberdesc).
Details
Ugur Koc
Released: June 25, 2022
Tables
IntuneAuditLogs
Keywords
OperationName,OperationCount,IntuneAuditLogs
Operators
IntuneAuditLogssummarizecountbysort by