User Risk Visualization last 90 days

Description

This visualization list the User Risk Events that have triggered in the last 90 days. The count per day is classified by the RiskEventType, those can amongs others be: - AnonymizedIPAddress - NewCountry - UnfamliliarFeatures

This visualization can give insight in the amount of risky events that have happened.

Query · kql

AADUserRiskEvents
| where TimeGenerated > ago(90d)
| summarize count() by bin(TimeGenerated, 1d), RiskEventType
| render columnchart
Raw source User Risk Visualization last 90 days · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# User Risk Visualization last 90 days

## Query Information

#### Description
This visualization list the User Risk Events that have triggered in the last 90 days. The count per day is classified by the RiskEventType, those can amongs others be:
- AnonymizedIPAddress
- NewCountry
- UnfamliliarFeatures

This visualization can give insight in the amount of risky events that have happened. 

#### References
- https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aaduserriskevents

## Sentinel
```KQL
AADUserRiskEvents
| where TimeGenerated > ago(90d)
| summarize count() by bin(TimeGenerated, 1d), RiskEventType
| render columnchart
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.