KQL return Security Event ID's and their count by computer

Question

I can’t figure out how to write a KQL query that would basically list all the Security Events ID’s and their count for each single computer.

This query returns all the Event ID per computer This query returns the count by Computer, EventID and Activity

Could anyone provide some hints please?

Thank you!

UPDATE:

This is close to what I'd like to have: However, is there a way to get something like this (basically, without any kung-fu within Excel):

Yoni L. · Answer

you could try using the count() aggregation function, with both Computer and EventId as the aggregation keys:

SecurityEvent
| where Timestamp > ago(12h)
| summarize count() by Computer, EventId

or, based on my understanding of the later comment, you could try this:

SecurityEvent
| where Timestamp > ago(12h)
| summarize count() by Computer, EventId
| summarize count_by_event_id = make_bag(pack(tostring(EventId), count_)) by Computer

KQL return Security Event ID's and their count by computer

1 Answers