Count and Percentage of DeviceType out of total inventory

Description

This query presents statistics on count and percentage of DeviceType out of total inventory

Query · kql

let TotalDevices = toscalar(DeviceInfo
| where Timestamp > ago(7d)
| summarize arg_max(Timestamp, *) by DeviceId
| summarize dcount(DeviceId));
DeviceInfo
| where Timestamp > ago(7d)
| summarize arg_max(Timestamp, *) by DeviceId
| summarize DevicesByDeviceType = dcount(DeviceId) by DeviceType
| extend TotalDevices=TotalDevices
| extend PercentageOfDeviceType =(DevicesByDeviceType * 100 ) / TotalDevices
Raw source Count and Percentage of DeviceType out of total inventory · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 37b7a9cb-1304-49c3-84e6-9de8545f4043
name: Count and Percentage of DeviceType out of total inventory
description: |
  This query presents statistics on count and percentage of DeviceType out of total inventory
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics: []
relevantTechniques: []
query: |
  let TotalDevices = toscalar(DeviceInfo
  | where Timestamp > ago(7d)
  | summarize arg_max(Timestamp, *) by DeviceId
  | summarize dcount(DeviceId));
  DeviceInfo
  | where Timestamp > ago(7d)
  | summarize arg_max(Timestamp, *) by DeviceId
  | summarize DevicesByDeviceType = dcount(DeviceId) by DeviceType
  | extend TotalDevices=TotalDevices
  | extend PercentageOfDeviceType =(DevicesByDeviceType * 100 ) / TotalDevices

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.