ExploitGuardASRStats (2)

Description

Get stats on ASR audit events - count events and machines per rule.

Query · kql

// View ASR audit events - but remove repeating events (e.g. multiple events with same machine, rule, file and process)
DeviceEvents
| where ActionType startswith "ASR" and ActionType endswith "Audited"
| summarize Timestamp =max(Timestamp) by DeviceName, ActionType,FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessId, SHA1
Raw source ExploitGuardASRStats (2) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: d8892c99-08d2-4385-a767-0754c41d7fb9
name: ExploitGuardASRStats (2)
description: |
  Get stats on ASR audit events - count events and machines per rule.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  // View ASR audit events - but remove repeating events (e.g. multiple events with same machine, rule, file and process)
  DeviceEvents
  | where ActionType startswith "ASR" and ActionType endswith "Audited"
  | summarize Timestamp =max(Timestamp) by DeviceName, ActionType,FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessId, SHA1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.