KQL Search

This query is designed to provide an overview of USB devices connected to computers within a network. It focuses on identifying and counting the number of times each type of USB device has been connected. Here's a simple breakdown of what the query does:

1. Data Source: It starts by looking at device events, specifically those where a device has been connected (indicated by the action type "PnpDeviceConnected").

2. Extracting Information: The query extracts additional details about each connected device, such as the class name, device description, vendor IDs, and device ID, from a field called AdditionalFields.

3. Filtering for USB Devices: It filters the data to only include devices identified as USB by checking the beginning of the device ID.

4. Organizing Data: The query organizes the data to focus on key attributes like class name, type, description, vendor IDs, and device ID.

5. Summarizing Events: It counts how many times each type of USB device (based on its description) has been connected.

6. Sorting: Finally, it sorts the results by the number of connection events for each device type, providing a clear view of which USB devices are most frequently connected.

This query can help network administrators monitor USB device usage and potentially detect unauthorized or suspicious device connections. Additionally, you can filter the results further by specific device descriptions if needed.