KQL Search

name : Endpoint - MDE/MDAV detection MITRE ATT&CK list
description : 
  - Case1 - Columnchart / MDE & MDAV detection with MITRE ATT&CK MITRE_ATTACK_list 
  - Case2 - Sort number / MDE & MDAV detection with MITRE ATT&CK MITRE_ATTACK_list
table :
  - AlertInfo
  - https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-alertinfo-table?view=o365-worldwide
query: |
    //Case1 - Columnchart / MDE & MDAV detection with MITRE ATT&CK MITRE_ATTACK_list 
    AlertInfo
    | where Timestamp > ago(7d)
    | where ServiceSource == "Microsoft Defender for Endpoint"
    | where isnotempty(AttackTechniques)
    | mv-expand DetailedAttackTechniques= parse_json(AttackTechniques)
    | summarize MITRE_ATTACK_list = count() by tostring(DetailedAttackTechniques)
    | render columnchart 


    //Case2 - Sort number / MDE & MDAV detection with MITRE ATT&CK MITRE_ATTACK_list
    AlertInfo
    | where Timestamp > ago(7d)
    | where ServiceSource == "Microsoft Defender for Endpoint"
    | where isnotempty(AttackTechniques)
    | mv-expand DetailedAttackTechniques= parse_json(AttackTechniques)
    | summarize MITRE_ATTACK_list = count() by tostring(DetailedAttackTechniques)
    | sort by MITRE_ATTACK_list desc