Visualize the devices in the defined machinegroups

Query · kql

DeviceInfo
| summarize dcount(DeviceName) by MachineGroup
| sort by dcount_DeviceName
| render columnchart with(title="Total Devices by MachineGroup")
Raw source Visualize the devices in the defined machinegroups · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Visualize the devices in the defined machinegroups

In order to get results the device groups need to be defined: [MS Documentation](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-groups?view=o365-worldwide)

## Defender XDR

```
DeviceInfo
| summarize dcount(DeviceName) by MachineGroup
| sort by dcount_DeviceName
| render columnchart with(title="Total Devices by MachineGroup")
```
## Sentinel
```
DeviceInfo
| summarize dcount(DeviceName) by MachineGroup
| sort by dcount_DeviceName
| render columnchart with(title="Total Devices by MachineGroup")
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.