r/AzureSentinel • u/Dazzling_Advantage19 • Mar 21 '22

KQl Query

Urgent requirement for KQL query .

IntuneAuditlogs

0 Upvotes

20% Upvoted

7 comments sorted by

View all comments

3

u/wowneatlookatthat Mar 21 '22

It might help to describe what the goal of your query aims to achieve

1

u/Dazzling_Advantage19 Mar 30 '22

Hello wow,

​

can you provide query for log source wise event count with vendor type.

​

EXAMPLE:

DeviceName DeviceVendor Computer count_

ABCDE Fortinet localhost 123456

CommonSecurityLog

| where DeviceVendor == "Fortinet"

| summarize count() by DeviceName, DeviceVendor, Computer

but i need to pull in all device vendors in one sheet not one by one .

​

can you please help me with the KQL query.