Visualisation of ActionTypes that have been seen in the Cloud App logs in the last 30 days
Visualization Actions Performed
Query
CloudAppEvents
| where TimeGenerated > ago(30d)
| summarize count() by ActionType
| render piechart with(title="ActionTypes triggered last 30 days")About this query
Visualisation of ActionTypes that have been seen in the Cloud App logs in the last 30 days
Defender XDR
CloudAppEvents
| where Timestamp > ago(30d)
| summarize count() by ActionType
| render piechart with(title="ActionTypes triggered last 30 days")
Sentinel
Explanation
This query is designed to create a visual representation of different types of actions recorded in cloud application logs over the past 30 days. Here's a simple breakdown:
-
Data Source: The query is looking at logs from cloud applications, specifically from a table called
CloudAppEvents. -
Time Frame: It filters the logs to only include events that occurred in the last 30 days.
-
Grouping: The query groups these events by the type of action that was recorded, known as
ActionType. -
Counting: It counts how many times each action type occurred in the logs during this period.
-
Visualization: The results are displayed as a pie chart, which provides a visual summary of the proportion of each action type relative to the others. The chart is titled "ActionTypes triggered last 30 days."
The query is written for two different systems, Defender XDR and Sentinel, but they perform the same function with slightly different field names (Timestamp vs. TimeGenerated).
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators