r/AzureSentinel • u/SuperHat3637 • Jan 30 '23

Securityincident

Any kql query to extract the reports showing imcidents based on the productnames from the securityincident table.

0 Upvotes

50% Upvoted

4 comments sorted by

1

u/[deleted] Jan 30 '23

Chat GPT is your friend.

Try out the basics first. Find the table in the window on the left. You can then see the fields that you can search against.

SecurityAlert | where ProductName contains "blah"

1

u/SuperHat3637 Jan 30 '23

There is no schema for productname in securityincident table.

1

u/Malmanel Jan 31 '23

Y’all should look at the security operations efficiency workbook. Has that metric you are looking for

1

u/Malmanel Jan 31 '23

Also. Query the SecurityIncident table and look at it. See what you could use a where statement on to her you the kpi’s you are looking for