对 AlertInfo 表的查询

MITRE ATT&CK 技术的警报

按 MITRE ATT&CK 技术按降序列出警报数。

AlertInfo
| where isnotempty(AttackTechniques)
| mvexpand todynamic(AttackTechniques) to typeof(string)
| summarize AlertCount = dcount(AlertId) by AttackTechniques
| sort by AlertCount desc