Query

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType == 'AntivirusDetection'
| summarize count() by bin(Timestamp, 1d)
| render linechart with(title="Antivirus Detections by Day")

About this query

Antivirus Detections by day

Description

This query visualizes the daily antivirus detections, which can give an indication in anomalous amount of activities that are performed in your environment.

Defender XDR

Sentinel

DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == 'AntivirusDetection'
| summarize count() by bin(TimeGenerated, 1d)
| render linechart with(title="Antivirus Detections by Day")

Explanation

This query is designed to track and visualize the number of antivirus detections on a daily basis over the past 30 days. It helps identify any unusual spikes or patterns in antivirus activity within your environment.

Here's a breakdown of what the query does:

Data Source: It uses the DeviceEvents table, which contains records of various events related to devices.
Time Frame: The query filters for events that have occurred in the last 30 days.
Event Type: It specifically looks for events where the ActionType is 'AntivirusDetection', meaning it focuses only on antivirus-related detections.
Aggregation: The query counts the number of antivirus detections for each day.
Visualization: The results are displayed as a line chart titled "Antivirus Detections by Day", which makes it easy to see trends and anomalies over the specified period.

There are two versions of the query, one for Defender XDR and another for Sentinel, but they essentially perform the same function with slight differences in the timestamp field used (Timestamp vs. TimeGenerated).

KQL Search