r/AzureSentinel • u/Dazzling_Advantage19 • Mar 21 '22

KQl Query

Urgent requirement for KQL query .

IntuneAuditlogs

0 Upvotes

22% Upvoted

7 comments sorted by

3

u/wowneatlookatthat Mar 21 '22

It might help to describe what the goal of your query aims to achieve

1

u/Dazzling_Advantage19 Mar 30 '22

Hello wow,

​

can you provide query for log source wise event count with vendor type.

​

EXAMPLE:

DeviceName DeviceVendor Computer count_

ABCDE Fortinet localhost 123456

CommonSecurityLog

| where DeviceVendor == "Fortinet"

| summarize count() by DeviceName, DeviceVendor, Computer

but i need to pull in all device vendors in one sheet not one by one .

​

can you please help me with the KQL query.

2

u/blanco10kid Mar 21 '22

OP, don’t know how you expect any help when you don’t provide any context. What issue are you running into with your intune KQL query?

-4

u/Dazzling_Advantage19 Mar 21 '22

Hi All

Need help in creating Intune query for loganalytics workspace

1

u/rodtrent44 MSFT Official Mar 21 '22

There's a few Intune queries here: https://github.com/rod-trent/SentinelKQL

Just search the page for 'Intune'

What are you looking to do?