HUNT - Enrollment spikes by hour
Enrollment Spikes
Query
IntuneAuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has "enroll"
| summarize Enrollments = count() by bin(TimeGenerated, 1h)
| extend Mean = toreal(series_stats_dynamic(todynamic(Enrollments)).avg)
| order by TimeGenerated descExplanation
This query is designed to monitor and visualize unusual spikes in device enrollments over time using data from Intune audit logs. Here's a simple breakdown:
- Data Source: It uses Intune audit logs from Azure Monitor.
- Time Frame: The query looks at data from the past 14 days.
- Operation Filter: It specifically filters for operations related to "enrollments."
- Aggregation: It counts the number of enrollments per hour.
- Baseline Calculation: It calculates the average number of enrollments to establish a baseline.
- Sorting: The results are sorted by the time they were generated, in descending order.
The purpose of this query is to help identify any unusual bursts in enrollment activity, which could indicate potential security issues or operational anomalies.
Details
David Alonso
Released: April 22, 2026
Tables
IntuneAuditLogs
Keywords
EnrollmentIntuneAuditLogsTimeGeneratedOperationNameEnrollmentsMean
Operators
IntuneAuditLogswhereagohassummarizecountbinextendtorealseries_stats_dynamictodynamicavgorder bydesc
Tactics
Persistence
MITRE Techniques