{"id":15396,"date":"2019-07-19T14:09:43","date_gmt":"2019-07-19T14:09:43","guid":{"rendered":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/?p=15396"},"modified":"2019-10-07T09:42:59","modified_gmt":"2019-10-07T08:42:59","slug":"azure-sentinel-dashboard-queries","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/","title":{"rendered":"Azure Sentinel &#8211; Dashboard queries"},"content":{"rendered":"<p>The vast majority of my day job at the moment includes Azure Sentinel. Some of the queries I&#8217;ve shown in the previous posts can be used to see data points for Sentinel as well.<\/p>\n<p>Typically I display all these on an <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/azure-portal\/azure-portal-dashboards\">Azure Dashboard<\/a>, but you can also just use the queries. Sentinel specifc DashBoards can be found <a href=\"https:\/\/github.com\/Azure\/Azure-Sentinel\/tree\/master\/Dashboards\">here<\/a><\/p>\n<p><strong>My Example Dashboard<\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"attachment-large size-large\" src=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/07\/Annotation-2019-07-19-142405-sent-overview-1024x679.jpg\" alt=\"Example Sentinel Dashboard\" width=\"1024\" height=\"679\" \/><\/p>\n<p>The new Data Tables that Sentinel uses are shown in this screen shot, but there are others that are related as well (you might want to include \u00a3<strong>Events <\/strong>?)<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"attachment-full size-full\" src=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/07\/Annotation-2019-07-19-142514-sent-schema.jpg\" alt=\"Sentinel Schema\" width=\"302\" height=\"418\" \/><\/p>\n<p>The query top left in the first picture, uses a Union to pull in the various Tables (I use a bin interval of 1hr to speed up the query (returns less data), which is especially useful as I normally want to look at a week or monthly view).<\/p>\n<p><code>let tBin = 1h;<br \/>\nunion isfuzzy=true<br \/>\n(<br \/>\n\/\/ Firewall vendors<br \/>\nCommonSecurityLog<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Office 365<br \/>\nOfficeActivity<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Azure Security Center - free<br \/>\nSecurityCenterFree<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Azure Security Center - Standard<br \/>\nSecurityEvent<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Security Alerts<br \/>\nSecurityAlert<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ DNS<br \/>\nDnsEvents<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Windows Firewall<br \/>\nWindowsFirewall<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Azure AD<br \/>\nSigninLogs<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Syslog<br \/>\nSyslog<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ AWS<br \/>\nAWSCloudTrail<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Symantec<br \/>\nSymantecICDX_CL<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ Hunting Bookmarks<br \/>\nHuntingBookmark<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ ThreatIntelligence Indicator<br \/>\nThreatIntelligenceIndicator<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n),<br \/>\n(<br \/>\n\/\/ LinuxAuditLog<br \/>\nLinuxAuditLog<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,tBin), SolutionName = Type<br \/>\n)<br \/>\n| sort by LogVolume<br \/>\n| render timechart title =\"Sentinel Log Volume by time\"<\/code><\/p>\n<p>Run the above <a href=\"https:\/\/portal.loganalytics.io\/Demo?q=H4sIAAAAAAAAA82WTW%2FaQBCG70j8hxEnkIhQVLWXioNjQouE6MGoya3a2AOMWM9W69lQo%2F74jiFgpyTHxPHJO%2B%2Fr2Ucz%2B2GLAnJDDGO43nztdgKTY6BiFfb7ciw%2BYLcDh6d%2FegEYjWBKHnfGWnhEzpwvajF2ee44wTR4knLu1rX0F4qQ58bTHkGFn86GHMepCyz9ATyU8EDcX1KO35DRG8FsWLENhpCoVZRsYXJU1GX5%2B8w1GL5M%2BGO1ohTh05fPdfgYi1KhR2VrCSzaB49wKhDEyIIermDlEWvjST%2FK02fah8BNxHBmfHaJfKtrQlqiPXNGFr0Ul3CHeEtwk0VSjydcHApVtARzR7pxd8V5J9fik3IptLDuokmjhbRmYp24rZIlZWGb59n%2F4%2Fetz11jMekgti5kS2%2BorYYlZW70bEib9TlGZvHk%2Flc8f2OuV8G%2Ba1riNdw4t9VJt43l8ySdlLYIlxuPRmZaK2tpjaz31owzSo04XxsvXS%2BY3rXlc%2BLwJwoZybN7%2FpXw26B1O5rXeakSnLNWQa9%2FJnpTiSZMN0YNQmL1816CVdPRVnY4%2BquPK2Ov8w8zjl3WEQkAAA%3D%3D&amp;timespan=P7D\">here<\/a><\/p>\n<p>The second query (top right) is this one, in structure its very similar &#8211; but it&#8217;s giving an indication of the data we have and where it may be generated from. You can remove or add Tables that are relevant to you &#8211; I use this as a way to remember where the data was added Sentinel vs. Log Analytics.<\/p>\n<p><code>union isfuzzy=true<br \/>\n(<br \/>\n\/\/ Firewall vendors<br \/>\nCommonSecurityLog<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = DeviceVendor<br \/>\n| sort by Records desc<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"\u2705  Sentinel or CEF data found\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Office 365<br \/>\nOfficeActivity<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Microsoft O365\"<br \/>\n| sort by Records desc<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, Log Analytics or Sentinel enabled\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Azure Security Center - free<br \/>\nSecurityCenterFree<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Azure Security Center Free\"<br \/>\n| sort by Records desc<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, ASC or Sentinel enabled\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Azure Security Center - Standard<br \/>\nSecurityEvent<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Azure Security Center Standard\"<br \/>\n| sort by Records desc<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, ASC or Sentinel enabled\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Security Alerts<br \/>\nSecurityAlert<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Azure Sentinel\"<br \/>\n| sort by Records desc<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, ASC or Sentinel\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ DNS<br \/>\nDnsEvents<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Microsoft DNS\"<br \/>\n| sort by Records desc<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, Log Analytics or Sentinel\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Windows Firewall<br \/>\nWindowsFirewall<br \/>\n| summarize Records = count() by SolutionName = Type,  Vendor = \"Microsoft Firewall\"<br \/>\n| sort by Records desc<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, Log Analytics or Sentinel\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Azure AD<br \/>\nSigninLogs<br \/>\n| summarize Records = count() by SolutionName = Type,  Vendor = \"Microsoft Azure AD\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, Log Analytics or Sentinel\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Syslog<br \/>\nSyslog<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Linux\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"data found, Log Analytics or Sentinel\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Event log<br \/>\nSyslog<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Azure Monitor\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"Log Analytics\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ AWS<br \/>\nAWSCloudTrail<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"AWS\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"\u2705  Sentinel or CEF data found\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Symantec<br \/>\nSymantecICDX_CL<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Symantec\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"\u2705  Sentinel data found\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ Hunting Bookmarks<br \/>\nHuntingBookmark<br \/>\n| summarize Records = count() by SolutionName = Type, Vendor = \"Azure Sentinel\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"\u2705  Sentinel data found\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ ThreatIntelligence Indicator<br \/>\nThreatIntelligenceIndicator<br \/>\n| summarize Records = count() by SolutionName = Type , Vendor = \"Azure Sentinel\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"\u2705  Sentinel data found\",\"no data\")<br \/>\n),<br \/>\n(<br \/>\n\/\/ LinuxAuditLog<br \/>\nLinuxAuditLog<br \/>\n| summarize Records = count() by SolutionName = Type , Vendor = \"Azure Sentinel\"<br \/>\n| extend PotentialDataSource = iif(Records&gt;0,\"\u2705  Sentinel data found\",\"no data\")<br \/>\n)<br \/>\n| sort by Records<\/code><\/p>\n<p><strong><br \/>\nExample output<\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"attachment-full size-full\" src=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/07\/Annotation-2019-07-19-143543-sen-data.jpg\" alt=\"Sen\" width=\"774\" height=\"331\" \/><\/p>\n<p>The next Four Charts on the left are these. I like to run these with a time-span of a week to give me an insight into any spikes or dips per solution:<\/p>\n<p><code><br \/>\nSecurityAlert<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,1h), SolutionName = Type<br \/>\n<\/code><\/p>\n<p><code><br \/>\nCommonSecurityLog<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,1h), SolutionName = Type<br \/>\n| render timechart title = \"CommonSecurityLog by time\"<br \/>\n<\/code><\/p>\n<p><code><br \/>\nSecurityEvent<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,1h), SolutionName = Type<br \/>\n| render timechart title = \"SecurityEvent by time\"<br \/>\n<\/code><\/p>\n<p><code><br \/>\nSyslog<br \/>\n| summarize LogVolume=count() by bin(TimeGenerated,1h), SolutionName = Type<br \/>\n| render timechart title = \"Syslog by time\"<br \/>\n<\/code><\/p>\n<p>The Bar Chart (2nd down on the right) is this query, which is similar to the cost ones here:<br \/>\n<a href=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/18\/azure-log-analytics-looking-at-data-and-costs-part-3\/\">https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/18\/azure-log-analytics-looking-at-data-and-costs-part-3\/ <\/a><\/p>\n<p>Note: you could also write the first query in this post in this more compressed format (I didn&#8217;t mainly as I wanted to keep the comments and structure readable). However if you want the compressed version click <a href=\"https:\/\/portal.loganalytics.io\/Demo?q=H4sIAAAAAAAAA3VSwW7bMAy9B8g%2FED7ZQ1qj2K1FBqTJugUItkOCdbdBlWlbiCxmEpXMwT5%2BZLoVK7DpJIrvPT6K9MjA9y4AzOGmvwOoa3iSkAm6SPkAR%2BMzJriCRDlavIWe%2BZBu67ohm64HZyMlavna0lBjuMqpNuccsd7nxFR%2FzxjHWgTbHCw7CjCdeC25MmOSkm9vmjstGXOAliJwj3AwiTWhiOkkB2W51ObzeZxzzAgnx%2F2zG1FghjcguJ9w6jGixmK%2FLLZj8tQVMyi2aHN0PL4%2FYuBiViwet0tPudlF47wCljQMFP7ANsqaTuD1eVFZeIysrF0f0fA6MHrvOgwW16Fx1jBFTW9cyD8WuXH8H8GPObAL3T3RfjBxr5xHFxo6pQcX8WS8eCu2rgsuiELSYByMlLPr5errt%2BXmX6KrkC5tXuC%2FHS8lxvgQEeXxc9s6iwuZxVFSRfXXz%2B3cgB8wYDSMDbyDxCYytTKH0nRUXkZWVYpPeRDL7owgzr6QzwPOLUk%2FZQVPo%2B5P%2BUpsphtWzWArUF2CT2bQ0e3GA17kKLLyXsT0MWJoUBZCdGwvRuTGXljSlv4beoXDM17JCiwmvwAjl0IUzwIAAA%3D%3D\">here<\/a><\/p>\n<p><code><br \/>\nunion isfuzzy=true withsource = tt *<br \/>\n| where tt in (\"Syslog\", \"SecurityEvent\",\"AWSCloudTrail\", \"CommonSecurityLog\",<br \/>\n\"SecurityAlert\", \"ThreatIntelligenceIndicator\", \"LinuxAuditLog\",<br \/>\n\"HuntingBookmark\")<br \/>\n| summarize<br \/>\nRecordCount = count(),<br \/>\nMbperRecord = round(count() \/ sum(_BilledSize\/(1024*1024)),2) ,<br \/>\nTotalGBytes = round(sum(_BilledSize\/(1024*1024*1024)),2)<br \/>\nby SolutionName = tt, _IsBillable<br \/>\n| sort by TotalGBytes desc<br \/>\n| render barchart<br \/>\n<\/code><\/p>\n<p>You can run the above <a href=\"https:\/\/portal.loganalytics.io\/Demo?q=H4sIAAAAAAAAA3WRwU4CMRBA7yT8w2RPu2QTlHj1AMQoCXpwSTySbjthG7odMzsV1%2FjxtqAEQXtoM5k3bzpt8JY87Kw0HQXWCLcgAiMYDj5h1yBjCq2HPKv6ztEmKyGrUAe20t%2B9oZeszKYv1dxRMCtW1iVgTm1L%2FgdbpqrhAH6vo2XqkCVVrRpGJQsv6JzdoNe48MZqJcQpvbQ%2BvE%2BDsfK3ELKH4MX6zYxo2yreZsV%2Bii60MbIfuIfOy55RE5s5xdI4uk5nXlzIH%2BtX5AMaKY6Uyb9ZGKcO%2BXpmnUNTxT7j%2FPpqcjNKW1GUkwIudCsS5e5nvWB31P0vOTFdXL%2FuoSIXJH7ik2oPv1fCetElk6od7l%2BAWBJ52tZgp1OO0RtkqBXrRkXsC79rx3YQAgAA&amp;timespan=P1D\">here<\/a><\/p>\n<p>The final Query (bottom right) is:<\/p>\n<p><code><br \/>\n\/\/ Top 5 Security Alerts<br \/>\nSecurityAlert<br \/>\n| summarize count() by AlertName<br \/>\n| top 5 by AlertName desc<br \/>\n| render piechart<br \/>\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The vast majority of my day job at the moment includes Azure Sentinel. Some of the queries I&#8217;ve shown in the previous posts can be used to see data points for Sentinel as well. Typically I display all these on an Azure Dashboard, but you can also just use the queries. Sentinel specifc DashBoards can<\/p>\n","protected":false},"author":424,"featured_media":17586,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"categories":[1],"post_tag":[128,424],"content-type":[],"coauthors":[],"class_list":["post-15396","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cross-industry","tag-azure","tag-hybridcloud"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Azure Sentinel - Dashboard queries - Microsoft Industry Blogs - United Kingdom<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Azure Sentinel - Dashboard queries - Microsoft Industry Blogs - United Kingdom\" \/>\n<meta property=\"og:description\" content=\"The vast majority of my day job at the moment includes Azure Sentinel. Some of the queries I&#8217;ve shown in the previous posts can be used to see data points for Sentinel as well. Typically I display all these on an Azure Dashboard, but you can also just use the queries. Sentinel specifc DashBoards can\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Industry Blogs - United Kingdom\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-19T14:09:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-10-07T08:42:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Azure Sentinel &#8211; Dashboard queries\",\"datePublished\":\"2019-07-19T14:09:43+00:00\",\"dateModified\":\"2019-10-07T08:42:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/\"},\"wordCount\":321,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg\",\"keywords\":[\"Azure\",\"Hybrid Cloud\"],\"articleSection\":[\"Cross-industry\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/\",\"name\":\"Azure Sentinel - Dashboard queries - Microsoft Industry Blogs - United Kingdom\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg\",\"datePublished\":\"2019-07-19T14:09:43+00:00\",\"dateModified\":\"2019-10-07T08:42:59+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg\",\"width\":800,\"height\":450,\"caption\":\"a close up of a logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Azure Sentinel &#8211; Dashboard queries\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/\",\"name\":\"Microsoft Industry Blogs - United Kingdom\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization\",\"name\":\"Microsoft Industry Blogs - United Kingdom\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png\",\"width\":259,\"height\":194,\"caption\":\"Microsoft Industry Blogs - United Kingdom\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Azure Sentinel - Dashboard queries - Microsoft Industry Blogs - United Kingdom","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/","og_locale":"en_US","og_type":"article","og_title":"Azure Sentinel - Dashboard queries - Microsoft Industry Blogs - United Kingdom","og_description":"The vast majority of my day job at the moment includes Azure Sentinel. Some of the queries I&#8217;ve shown in the previous posts can be used to see data points for Sentinel as well. Typically I display all these on an Azure Dashboard, but you can also just use the queries. Sentinel specifc DashBoards can","og_url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/","og_site_name":"Microsoft Industry Blogs - United Kingdom","article_published_time":"2019-07-19T14:09:43+00:00","article_modified_time":"2019-10-07T08:42:59+00:00","og_image":[{"width":800,"height":450,"url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Written by":"","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/"},"author":{"name":"","@id":""},"headline":"Azure Sentinel &#8211; Dashboard queries","datePublished":"2019-07-19T14:09:43+00:00","dateModified":"2019-10-07T08:42:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/"},"wordCount":321,"commentCount":1,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg","keywords":["Azure","Hybrid Cloud"],"articleSection":["Cross-industry"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/","name":"Azure Sentinel - Dashboard queries - Microsoft Industry Blogs - United Kingdom","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg","datePublished":"2019-07-19T14:09:43+00:00","dateModified":"2019-10-07T08:42:59+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2017\/08\/UK-Hybrid-Cloud-Team-Black.jpg","width":800,"height":450,"caption":"a close up of a logo"},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/cross-industry\/2019\/07\/19\/azure-sentinel-dashboard-queries\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/"},{"@type":"ListItem","position":2,"name":"Azure Sentinel &#8211; Dashboard queries"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/","name":"Microsoft Industry Blogs - United Kingdom","description":"","publisher":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#organization","name":"Microsoft Industry Blogs - United Kingdom","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png","contentUrl":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-content\/uploads\/sites\/22\/2019\/08\/Microsoft-Logo.png","width":259,"height":194,"caption":"Microsoft Industry Blogs - United Kingdom"},"image":{"@id":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/posts\/15396"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/users\/424"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/comments?post=15396"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/posts\/15396\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/media\/17586"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/media?parent=15396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/categories?post=15396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/post_tag?post=15396"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/content-type?post=15396"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-gb\/industry\/blog\/wp-json\/wp\/v2\/coauthors?post=15396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}