Visualisation of ActionTypes that have been seen in the Cloud App logs in the last 30 days

Query · kql

CloudAppEvents
| where Timestamp > ago(30d)
| summarize count() by ActionType
| render piechart with(title="ActionTypes triggered last 30 days")
Raw source Visualisation of ActionTypes that have been seen in the Cloud App logs in the last 30 days · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Visualisation of ActionTypes that have been seen in the Cloud App logs in the last 30 days

## Defender XDR
```
CloudAppEvents
| where Timestamp > ago(30d)
| summarize count() by ActionType
| render piechart with(title="ActionTypes triggered last 30 days")
```

## Sentinel
```
CloudAppEvents
| where TimeGenerated > ago(30d)
| summarize count() by ActionType
| render piechart with(title="ActionTypes triggered last 30 days")
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.