KQL Search Visits
Query
DeviceNetworkEvents
| where RemoteUrl has "kqlsearch.com"
| summarize TotalDevices = dcount(DeviceId) by bin(Timestamp, 1d)
| render columnchart with(title="KQLSearch.com visits", xtitle="Date", ytitle="TotalDevices")About this query
KQLSearch Visits
Query Information
Description
Visualize the visits to kqlsearch.com in a columnchart.
References
Defender XDR
Sentinel
DeviceNetworkEvents
| where RemoteUrl has "kqlsearch.com"
| summarize TotalDevices = dcount(DeviceId) by bin(TimeGenerated, 1d)
| render columnchart with(title="KQLSearch.com visits", xtitle="Date", ytitle="TotalDevices")
Explanation
This query is designed to visualize the number of unique devices visiting the website "kqlsearch.com" each day. It uses data from network events to count how many different devices accessed the site. The results are then displayed in a column chart, where the x-axis represents the date and the y-axis shows the total number of unique devices. The query is written for two different platforms, Defender XDR and Sentinel, with a slight difference in the timestamp field used for binning the data (Timestamp for Defender XDR and TimeGenerated for Sentinel).
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
DeviceNetworkEvents
Keywords
DeviceNetworkEventsRemoteUrlTimestampTimeGeneratedTotalDevices
Operators
DeviceNetworkEventswherehassummarizedcountbybinrenderwith