KQL Search

Query Details

HomeAI ToolsDevice Query

Identity Visualize Guest Redemptionswith Trend

Query

//Visualize how many guests are redeeming invites over the time period with trend

//Data connector required for this query - Azure Active Directory - Audit Logs

let StartDate = now(-180d);
let EndDate = now();
AuditLogs
| where OperationName == "Redeem external user invite"
| make-series TotalInvites=count() on TimeGenerated in range(StartDate, EndDate, 1d)
| extend (RSquare, SplitIdx, Variance, RVariance, TrendLine)=series_fit_2lines(TotalInvites)
| project TimeGenerated, TotalInvites, TrendLine
| render timechart with (title="Guest Invites redeemed over time with trend")

Explanation

This query visualizes the number of guests redeeming invites over a specific time period. It uses the Azure Active Directory - Audit Logs data connector. The query calculates the total number of invites redeemed each day and creates a trend line to show the overall trend. The results are then displayed in a time chart.

Details

Matt Zorich profile picture

Matt Zorich

Released: June 17, 2022

Tables

AuditLogs

Keywords

Devices,Intune,User,KQL,Query,Keywords,Trend,Data,Connector,AzureActiveDirectory,AuditLogs,StartDate,EndDate,OperationName,Redeemexternaluserinvite,TotalInvites,TimeGenerated,RSquare,SplitIdx,Variance,RVariance,TrendLine,render,timechart,title,GuestInvites.

Operators

letwheremake-seriesoninrangeextendprojectrender

Actions