Query Execution Statistics

Description

List the query execution statistics for your Log Analytics Workspace, this returns the UnqiueQueryCount and the TotalQueriesExecuted for each Azure Active Directory User. To audit the query executions the Azure Diagnostics settings for the Log Analytics Workspace need to be set, see references on how this can be implemented.

Query · kql

LAQueryLogs
| summarize UnqiueQueryCount = dcount(QueryText), TotalQueriesExecuted = count() by AADEmail
| sort by AADEmail
Raw source Query Execution Statistics · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Query Execution Statistics

## Query Information

#### Description
List the query execution statistics for your Log Analytics Workspace, this returns the *UnqiueQueryCount* and the *TotalQueriesExecuted* for each Azure Active Directory User. 
To audit the query executions the Azure Diagnostics settings for the Log Analytics Workspace need to be set, see references on how this can be implemented.

#### References
- https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-audit

## Sentinel
```KQL
LAQueryLogs
| summarize UnqiueQueryCount = dcount(QueryText), TotalQueriesExecuted = count() by AADEmail
| sort by AADEmail
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.