KQL-Queries

Hi, I'm Ian Hanley and here are my deceptively simple KQL queries I keep coming back to in order to solve complicated problems.

Name		Name	Last commit message	Last commit date
Latest commit History 125 Commits
'Sort' function result comparison.kql		'Sort' function result comparison.kql
90 Day Billable Ingest Volume.kql		90 Day Billable Ingest Volume.kql
Average Daily Ingest Volume.kql		Average Daily Ingest Volume.kql
Cost of EventID by Computer.kql		Cost of EventID by Computer.kql
Cost of EventID.kql		Cost of EventID.kql
Cost of Syslog Events by Severity.kql		Cost of Syslog Events by Severity.kql
Cost of a Table.kql		Cost of a Table.kql
Cost_of_workstations_logging_direct_to_Sentinel.kql		Cost_of_workstations_logging_direct_to_Sentinel.kql
Day-by-Day-Change.kql		Day-by-Day-Change.kql
Efficiency Exercise.kql		Efficiency Exercise.kql
EventID by _BilledSize.kql		EventID by _BilledSize.kql
GB per Table.kql		GB per Table.kql
How Many Times Does This EventID fire from This Machine on This Day.kql		How Many Times Does This EventID fire from This Machine on This Day.kql
How loud is a Table?.kql		How loud is a Table?.kql
README.md		README.md
Top_10_Billable_Log_Sources.kql		Top_10_Billable_Log_Sources.kql
Top_10_Billable_MDE_Tables.kql		Top_10_Billable_MDE_Tables.kql
Top_10_EventIDs_Windows_SecurityEvents.kql		Top_10_EventIDs_Windows_SecurityEvents.kql
Top_10_Tables (exclude MDE).kql		Top_10_Tables (exclude MDE).kql
Which Accounts are Throwing this EventID?.kql		Which Accounts are Throwing this EventID?.kql
Which Devices are Throwing this EventID?.kql		Which Devices are Throwing this EventID?.kql
Which EventID fires the most in a month?.kql		Which EventID fires the most in a month?.kql

EEN421/KQL-Queries

Folders and files

Latest commit

History

Repository files navigation

KQL-Queries

About

Topics

Resources

Stars

Watchers

Forks