ADAssessmentRecommendation 數據表的查詢

依焦點區域的 AD 建議

依焦點區域計算所有AD重新整理。

ADAssessmentRecommendation 
| summarize AggregatedValue = count() by FocusArea  

依電腦提供的AD建議

計算計算機失敗結果的AD建議。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Computer

依樹系的 AD 建議

依樹系計算失敗結果的AD建議。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Forest

依網域的 AD 建議

依網域計算失敗結果的AD建議。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Domain

DomainController 的 AD 建議

計算域控制器失敗結果的AD建議。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by DomainController

AffectedObjectType 的 AD 建議

依受影響的物件類型計算失敗結果的AD建議。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by AffectedObjectType

每個唯一 AD 建議觸發程式有多少次？

依建議計算失敗結果的AD建議。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Recommendation

高優先順序 AD 評定安全性建議

建議標識碼導致結果失敗的最新高優先順序安全性建議。

ADAssessmentRecommendation
| where FocusArea == 'Security and Compliance' and RecommendationResult == 'Failed' and RecommendationScore>=35
| summarize arg_max(TimeGenerated, *) by RecommendationId