Summary Rules - Unique Actions
Unique Actions
Query
union *
| extend Action = coalesce(Operation, OperationName, OperationNameValue, ActionType)
| where isnotempty(Action)
| summarize TotalEvents = count() by Type, Action
| extend RetrievalDate = StartDate
| sort by TypeAbout this query
Summary Rules - Unique Actions
Query Information
Description
This summary rule saves all unique actions and how often they appear in your environment to the custom table or your choice.
This allows for easy retrieval of statistics and trends on how many unique actions are found in the environment each day.
Recommended Schedule: 24 hours.
Recommended Delay: 60 minutes.
References
- https://learn.microsoft.com/en-us/azure/sentinel/summary-rules
- https://kqlquery.com/posts/sentinel-summary-rules/
Sentinel
Explanation
This query is designed to collect and store information about unique actions occurring in your environment. Here's a simple breakdown of what it does:
-
Combine Data: It gathers data from all available sources (indicated by
union *). -
Identify Actions: It creates a new field called
Actionby selecting the first non-empty value from a list of possible fields (Operation,OperationName,OperationNameValue,ActionType). This helps in standardizing the action names. -
Filter Non-Empty Actions: It filters out any records where the
Actionfield is empty, ensuring only meaningful actions are considered. -
Count Unique Actions: It counts how many times each unique action occurs, grouped by the type of event and the action itself.
-
Add Retrieval Date: It adds a field called
RetrievalDateto record when the data was collected. -
Sort Results: Finally, it sorts the results by the type of event.
The query is intended to run once every 24 hours with a 60-minute delay to ensure all data is collected. This setup helps in tracking statistics and trends of actions in your environment over time.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators