KQL Search

Query Details

Intune Audit Events

Query

IntuneAuditLogs 
|summarize Auditevents = count() by OperationName 
| sort by Auditevents

Explanation

The query is counting the number of audit events in the IntuneAuditLogs table and grouping them by the OperationName. The results are then sorted by the number of audit events.