Visualize Antivirus Detection By Day
Description
This KQL query visualizes the daily antivirus detection, which can give an indication in anomalous amount of activities that are performed in your environment.
Query
Microsoft Defender For Endpoint
Kusto
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType == 'AntivirusDetection'
| summarize count() by bin(Timestamp, 1d)
| render linechart with(title="Antivirus Detections by Day")Microsoft Sentinel
Kusto
DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == 'AntivirusDetection'
| summarize count() by bin(TimeGenerated, 1d)
| render linechart with(title="Antivirus Detections by Day")