Visualize Daily Incident Triggers
Description
This KQL query visualizes the daily triggers in MDE or Sentinel in a columnchart. This can give insight into spikes in the amount of triggers.
Query
Microsoft Defender For Endpoint
Kusto
AlertInfo
| where Timestamp > ago(30d)
// Collect the first entry of each alert
| summarize arg_min(Timestamp, *) by AlertId
| summarize Total = count() by bin(Timestamp, 1d)
| render columnchart with(title="Incident triggers last 30 days")Microsoft Sentinel
Kusto
SecurityIncident
| where TimeGenerated > ago(30d)
// Collect the first entry of each alert
| summarize arg_min(TimeGenerated, *) by IncidentNumber
| summarize Total = count() by bin(TimeGenerated, 1d)
| render columnchart with(title="Incident triggers last 30 days")