ConfigurationChange 數據表的查詢
已停止的 Windows 服務
尋找過去 30 分鐘內停止的所有 Windows 服務。
// To create an alert for this query, click '+ New alert rule'
ConfigurationChange // (relies on the Change Tracking solution):
| where ConfigChangeType == "WindowsServices" and SvcChangeType == "State"
| where SvcPreviousState == "Running" and SvcState == "Stopped"
| where SvcStartupType == "Auto" and TimeGenerated > ago(30m)
軟體變更
清單 依時間 (最新) 排序的軟體變更。
ConfigurationChange
| where ConfigChangeType == "Software"
| sort by TimeGenerated desc
服務變更
清單 服務變更會依時間排序, (最新的第一個) 。
ConfigurationChange
| where ConfigChangeType == "Services"
| sort by TimeGenerated desc
每部電腦的軟體變更類型
計算計算機的軟體變更。
ConfigurationChange
| where ConfigChangeType == "Software"
| summarize AggregatedValue = count() by Computer
已停止的服務
清單 依時間排序的停止服務變更。
ConfigurationChange
| where ConfigChangeType == "WindowsServices" and SvcState == "Stopped"
| sort by TimeGenerated desc
每個類別的軟體變更計數
依變更類別計算軟體變更。
ConfigurationChange
| where ConfigChangeType == "Software"
| summarize AggregatedValue = count() by ChangeCategory
已移除軟體變更
顯示已移除之軟體的變更記錄。
ConfigurationChange
| where ConfigChangeType == "Software" and ChangeCategory == "Removed"
| order by TimeGenerated desc
意見反應
https://aka.ms/ContentUserFeedback。
即將登場:在 2024 年,我們將逐步淘汰 GitHub 問題作為內容的意見反應機制,並將它取代為新的意見反應系統。 如需詳細資訊,請參閱:提交並檢視相關的意見反應