Visualize FileTypes based on DeviceFileEvents

Query · kql

let TimeFrame = 7d;
DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| extend FileType = tostring(parse_json(AdditionalFields).FileType)
| where isnotempty(FileType)
| summarize Total = count() by FileType
| render piechart with(title="FileTypes used")
Raw source Visualize FileTypes based on DeviceFileEvents · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Visualize FileTypes based on DeviceFileEvents

## Defender XDR

```
let TimeFrame = 7d;
DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| extend FileType = tostring(parse_json(AdditionalFields).FileType)
| where isnotempty(FileType)
| summarize Total = count() by FileType
| render piechart with(title="FileTypes used")
```
## Sentinel
```
let TimeFrame = 7d;
DeviceFileEvents
| where Timestamp > ago(TimeFrame)
| extend FileType = tostring(parse_json(AdditionalFields).FileType)
| where isnotempty(FileType)
| summarize Total = count() by FileType
| render piechart with(title="FileTypes used")
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.