Office Activity Visualize Files Sharedto Guests

//Visualize the files shared to guests from Office 365 over time //Data connector required for this query - Office 365 let timerange=90d; OfficeActivity | where TimeGenerated > ago(timerange) | where Operation in ("SecureLinkCreated", "AddedToSecureLink") | where TargetUserOrGroupType == "Guest" | summarize Count=count()by bin(TimeGenerated, 1d) | render timechart with (ytitle="File Count", title="Files shared with guests over time")

Explanation

This query visualizes the number of files shared with guests from Office 365 over a specific time period. It uses the Office 365 data connector and filters the data based on the operations "SecureLinkCreated" and "AddedToSecureLink". It also filters for TargetUserOrGroupType being "Guest". The query then groups the data by day and counts the number of files shared on each day. Finally, it renders a time chart showing the file count over time, with the y-axis representing the file count and the title indicating the purpose of the chart.

Details

Matt Zorich

Released: June 17, 2022

Tables

OfficeActivity

Keywords

Files,OfficeActivity,TimeGenerated,Operation,SecureLinkCreated,AddedToSecureLink,TargetUserOrGroupType,Guest,Count,Timechart,FileCount,Filessharedwithguestsovertime

Operators

lettimerange=90dOfficeActivitywhereTimeGenerated>ago()|Operationin()whereTargetUserOrGroupType=="Guest"summarizeCount=count()bybin()rendertimechartwith()ytitle="File Count"title="Files shared with guests over time"

KQL Search