ExploitGuardASRStats (1)

Description

Get stats on ASR audit events - count events and machines per rule.

Query · kql

// Get stats on ASR blocks - count events and machines per rule
DeviceEvents
| where ActionType startswith "Asr" and ActionType endswith "Blocked"
// Count total stats - count events and machines per rule
| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType
Raw source ExploitGuardASRStats (1) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f809e596-87ff-4849-8eeb-cc636f0c92a0
name: ExploitGuardASRStats (1)
description: |
  Get stats on ASR audit events - count events and machines per rule.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  // Get stats on ASR blocks - count events and machines per rule
  DeviceEvents
  | where ActionType startswith "Asr" and ActionType endswith "Blocked"
  // Count total stats - count events and machines per rule
  | summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.