ExploitGuardStats (1)

Description

Get stats on ExploitGuard blocks - count events and machines per rule.

Query · kql

// View ExploitGuard audit events - but remove repeating events (e.g. multiple events with same machine, rule, file and process)
DeviceEvents
| where ActionType startswith "ExploitGuard" and ActionType endswith "Audited"
| summarize Timestamp =max(Timestamp) by DeviceName, ActionType,FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessId, SHA1
Raw source ExploitGuardStats (1) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 263f7a27-7c44-4e28-adc3-df5cb3fdc2bb
name: ExploitGuardStats (1)
description: |
  Get stats on ExploitGuard blocks - count events and machines per rule.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  // View ExploitGuard audit events - but remove repeating events (e.g. multiple events with same machine, rule, file and process)
  DeviceEvents
  | where ActionType startswith "ExploitGuard" and ActionType endswith "Audited"
  | summarize Timestamp =max(Timestamp) by DeviceName, ActionType,FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessId, SHA1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.