Health Checks
top-10-alerts.kql
Top 10 alert names over 90 days with percentage of total and color-coded impact level (High / Moderate / Low).
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Top 10 Alerts with Percentage of Total Alerts - Updated/Advanced
let totalAlerts = toscalar(SecurityAlert
| where TimeGenerated > ago(90d)
| summarize TotalCount = count());
SecurityAlert
| where TimeGenerated > ago(90d)
| summarize Count = count() by AlertName
| top 10 by Count desc
| extend PercentageValue = round((Count * 100.0) / totalAlerts, 2)
| extend Percentage = strcat(PercentageValue, '%')
| extend Alert_Severity = case(
PercentageValue > 20,
'🔥 High Impact',
PercentageValue > 10,
'⚠️ Moderate',
'✅ Low Impact'
)
| project AlertName, Count, Percentage, ["Impact Level"] = Alert_Severity