Azure Sentinel Num Of Open Incidents

AzureSent-0127 41 Reputation points
2022-01-21T17:39:24.68+00:00

I'd like to know if there is a way to write a query that returns:

  1. Total number of Incidents created.
  2. Total number of "Closed" and "Open" Incidents.

So far I have tried:

SecurityIncident
| distinct ProviderIncidentId
| summarize by ProviderIncidentId

The goal is to create a visulaization that show cases:

  1. Total Num of Incidents
  2. How many are "Closed"
  3. How many are "Open"
  4. etc.
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
983 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andrew Blumhardt 9,496 Reputation points Microsoft Employee
    2022-01-21T18:03:10.91+00:00

    Check out the SOC Efficiency Workbook. That may be closer to what you are working towards.

    SecurityIncident
    | summarize count() by Status

    167316-image.png

    1 person found this answer helpful.