Function: SignatureRingDistribution()

# Function: SignatureRingDistribution()

## Query Information

#### Description
This function returns the Signature Ring Distribution for the gradual rollout of AvPlatformRing, AvSignatureRing and AvEngineRing. The function can be called using one of these parameters to return the total devices and their rollout configuration.

#### References
- https://learn.microsoft.com/en-us/defender-endpoint/manage-gradual-rollout


## Defender XDR
```
let SignatureRingDistribution = (RingName:string) { 
    DeviceTvmInfoGathering
    | extend AvSignatureRing = tostring(parse_json(AdditionalFields).AvSignatureRing), AvPlatformRing = tostring(parse_json(AdditionalFields).AvPlatformRing), AvEngineRing = tostring(parse_json(AdditionalFields).AvEngineRing)
    | summarize TotalDevices = dcount(DeviceId) by column_ifexists(RingName, "AvSignatureRing")
    | extend RingDescription = case(
    column_ifexists(RingName, "AvSignatureRing") == "1", "Beta Channel - Prerelease",
    column_ifexists(RingName, "AvSignatureRing") == "2", "Current Channel (Preview)",
    column_ifexists(RingName, "AvSignatureRing") == "3", "Current Channel (Staged)",
    column_ifexists(RingName, "AvSignatureRing") == "4", "Current Channel (Broad)",
    column_ifexists(RingName, "AvSignatureRing") == "5", "Not Configured",
    column_ifexists(RingName, "AvSignatureRing") == "6", "Critical: Time Delay",
            "Unknown")
    | project RingDescription, TotalDevices
    | render piechart
};
//SignatureRingDistribution("AvPlatformRing")
SignatureRingDistribution("AvSignatureRing")
//SignatureRingDistribution("AvEngineRing")
```