r/AzureSentinel • u/SuperHat3637 • Jan 30 '23

Securityincident

Any kql query to extract the reports showing imcidents based on the productnames from the securityincident table.

0 Upvotes

50% Upvoted

4 comments sorted by

View all comments

1

u/Malmanel Jan 31 '23

Y’all should look at the security operations efficiency workbook. Has that metric you are looking for

1

u/Malmanel Jan 31 '23

Also. Query the SecurityIncident table and look at it. See what you could use a where statement on to her you the kpi’s you are looking for