Visualize FileTypes based on DeviceFileEvents
Visualization File Types
Query
let TimeFrame = 7d;
DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| extend FileType = tostring(parse_json(AdditionalFields).FileType)
| where isnotempty(FileType)
| summarize Total = count() by FileType
| render piechart with(title="FileTypes used")About this query
Visualize FileTypes based on DeviceFileEvents
Defender XDR
Sentinel
let TimeFrame = 7d;
DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| extend FileType = tostring(parse_json(AdditionalFields).FileType)
| where isnotempty(FileType)
| summarize Total = count() by FileType
| render piechart with(title="FileTypes used")
Explanation
This query is designed to visualize the types of files that have been involved in device file events over the past 7 days. Here's a simple breakdown of what it does:
-
Time Frame: It looks at data from the last 7 days.
-
Data Source: It uses the
DeviceFileEventstable, which contains records of file-related events on devices. -
Extract File Type: It extracts the
FileTypeinformation from theAdditionalFieldscolumn, which is stored in JSON format. -
Filter Non-Empty File Types: It filters out any records where the
FileTypeis not specified or empty. -
Count File Types: It counts how many times each file type appears in the data.
-
Visualize: It creates a pie chart to display the distribution of different file types used, with the title "FileTypes used".
This query is used in both Defender XDR and Sentinel to provide a visual representation of file type usage based on recent device file events.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators