mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
8 lines
271 B
Plaintext
8 lines
271 B
Plaintext
CommonSecurityLog
|
|
| where TimeGenerated > ago(1d)
|
|
| summarize Count = count(),
|
|
DistinctDestinationIps = dcount(DestinationIP),
|
|
NoofBytesTransferred = sum(SentBytes),
|
|
NoofBytesReceived = sum(ReceivedBytes)
|
|
by SourceIP, DeviceVendor
|