KQL Query Visits
Query
DeviceNetworkEvents
| where RemoteUrl has "kqlquery.com"
| summarize TotalDevices = dcount(DeviceId) by bin(Timestamp, 1d)
| render columnchart with(title="kqlquery.com visits", xtitle="Date", ytitle="TotalDevices")About this query
KQLQuery Visits
Query Information
Description
Visualize the visits to KQLQuery.com in a columnchart.
References
Defender XDR
Sentinel
DeviceNetworkEvents
| where RemoteUrl has "kqlquery.com"
| summarize TotalDevices = dcount(DeviceId) by bin(TimeGenerated, 1d)
| render columnchart with(title="kqlquery.com visits", xtitle="Date", ytitle="TotalDevices")
Explanation
This query is designed to visualize the number of unique devices visiting the website "kqlquery.com" each day. It uses data from network events to count how many distinct devices accessed the site on a daily basis. The results are then displayed in a column chart, with the x-axis representing the date and the y-axis showing the total number of unique devices. The chart is titled "kqlquery.com visits." The query is written for two different platforms, Defender XDR and Sentinel, with a slight difference in the timestamp field used for binning the data (Timestamp vs. TimeGenerated).
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
DeviceNetworkEvents
Keywords
DeviceNetworkEventsRemoteUrlIdTimestampTimeGenerated
Operators
wherehassummarizedcountbybinrenderwith