Commonality of Operating Systems

Description

This query provides the commonality of operating systems seen in the inventory

Query · kql

//
DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| summarize dcount(DeviceId) by OSDistribution
Raw source Commonality of Operating Systems · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5a540d69-a196-4e1f-9029-df8a100aa4a7
name: Commonality of Operating Systems
description: |
  This query provides the commonality of operating systems seen in the inventory
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics:
- Resource Development
relevantTechniques: []
query: |
  //
  DeviceInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | summarize dcount(DeviceId) by OSDistribution

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.