Edit

Share via

Queries for the AggregatedSecurityAlert table

  • Article

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Group Aggregated Security Alerts by Sector

Aggregated Security alerts grouped by originated sector.

source
| project
    TimeGenerated = todatetime(TimeGenerated),
    DisplayName = AlertDisplayName,
    AlertName = AlertDisplayName,
    AlertSeverity = Severity,
    Description,
    ProviderName,
    VendorName,
    VendorOriginalId = ProviderAlertId,
    SystemAlertId,
    AlertType,
    ConfidenceLevel,
    ConfidenceScore = tofloat(ConfidenceScore),
    StartTime = todatetime(StartTimeUtc),
    EndTime = todatetime(EndTimeUtc),
    ProcessingEndTime = todatetime(ProcessingEndTime),
    RemediationSteps = tostring(todynamic(RemediationSteps)),
    ExtendedProperties = tostring(todynamic(ExtendedProperties )),
    Entities = tostring(todynamic(Entities)),
    SourceSystem = "Detection",
    ExtendedLinks = tostring(todynamic(ExtendedLinks)),
    ProductName,
    ProductComponentName,
    Status,
    CompromisedEntity,
    Tactics = Intent,
    Techniques = tostring(todynamic(Techniques)),
    SubTechniques = tostring(todynamic(SubTechniques)),
    PartnerId,
    PartnerDisplayName,
    PartnerMetadata = tostring(todynamic(PartnerMetadata)),
    AggregatedSecurityAlertRuleIds,
    AggregatedSecurityAlertRuleNames