Query

// Timeframe to collect incident statistics
let timeframe = 7d;
AlertInfo
| where Timestamp > ago(timeframe)
// Collect the first entry of each alert
| summarize arg_min(Timestamp, *) by AlertId
// Get the alert statistics
| summarize Triggers = count(), AlertIds = make_set(AlertId) by Title
| top 10 by Triggers

About this query

Most Triggered Incidents

Query Information

Description

The results of this query provide insight in the top 10 incidents that have triggered in your selected timeframe, this can give indications on which incidents should be addressed to limit potential false positives.

Defender XDR

Sentinel

let timeframe = 7d;
SecurityIncident
| where TimeGenerated > ago(timeframe)
// Collect the first entry of each alert
| summarize arg_min(TimeGenerated, *) by IncidentNumber
// Get the alert statistics
| summarize Triggers = count(), AlertIds = make_set(IncidentNumber) by Title
| top 10 by Triggers

Explanation

This query is designed to identify the top 10 most frequently triggered incidents within a specified timeframe (default is the last 7 days). It helps in understanding which incidents are occurring most often, potentially indicating areas where false positives might need to be addressed.

Here's a simplified breakdown of what each part of the query does:

Timeframe Selection: The query looks at incidents that have occurred in the last 7 days.
Data Filtering: It filters the incidents to only include those that have been triggered within this timeframe.
Unique Incident Identification: For each alert or incident, it collects the first occurrence to avoid counting duplicates.
Incident Statistics: It counts how many times each type of incident has been triggered and groups them by their titles.
Top 10 Incidents: Finally, it sorts these incidents by the number of times they were triggered and selects the top 10. This process is done separately for two systems: Defender XDR and Sentinel, but the logic is essentially the same for both. The result is a list of the top 10 incidents that need attention, potentially to reduce false positives.

KQL Search