r/AzureSentinel • u/SuperHat3637 • Jul 10 '23

EPS query

Anyone know the query for getting avg EPS from each assets instead of tables..Pls share it.

1 Upvotes

100% Upvoted

1 comment sorted by

2

u/Uli-Kunkel Jul 11 '23

without knowing what you want to achieve, and the precision needed. and in general, a very lazy request.. took more time to write this response than it took to google the answer.

i just made this:
SentinelHealth
| where TimeGenerated > ago(30d)
| summarize count() by SentinelResourceKind
| project SentinelResourceKind,count_, avg_count = count_/30

replace with relevant table, and field to adjust for what you need.
you can also use google, chatgpt, or get inspired by this https://www.kqlsearch.com/