ExploitGuardASRStats

Description

Get stats on ASR audit events - count events and machines per rule.

Query · kql

DeviceEvents
| where ActionType startswith "Asr" and ActionType endswith "Audited"
// Count total stats - count events and machines per rule
| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType
Raw source ExploitGuardASRStats · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4302c0fa-dda5-4a6a-b29a-a96736bce088
name: ExploitGuardASRStats
description: |
  Get stats on ASR audit events - count events and machines per rule.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents
  | where ActionType startswith "Asr" and ActionType endswith "Audited"
  // Count total stats - count events and machines per rule
  | summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.