Sentinel KQL - Is there an easy way to get the top 10 incidents?

Georges Hayek 41 Reputation points
2022-11-30T09:31:41.743+00:00

Hello guys,

I hope someone can help me with the below.

I need a query to get the top 10 incidents in the last three month from Azure sentinel. I am new in KQL.

thank you,

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
989 questions
Accepted answer
  1. George Moise 2,346 Reputation points Microsoft Employee
    2022-11-30T13:25:51.777+00:00

    Hi @Georges Hayek ,
    Just in case you need to get the top 10 incidents (based on the count of incidents), I leave you the following Kusto query that provides that information:

    SecurityIncident
    | summarize ["Number of Incidents"] = count(), ["Incidents List"]= make_list(IncidentNumber) by Title, Severity
    | top 10 by ['Number of Incidents'] desc
    | project-reorder ['Number of Incidents'], Severity, Title

    I hope it helps. (If so, don't forget to mark as an answer :))

    BR,
    George

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest