How Many Times Does This Eventid Fire From This Machine

Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

KQL Library  /  Hunting

 Hunting Eventid Forensics how-many-times-does-this-eventid-fire-from-this-machine.kql

Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

Tactics Discovery
Platforms Windows
Data SecurityEvent
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
//How Many Times Has This Machine Thrown This Event Today?
// Source: Anatomy Of A KQL Query Part 2 (2023-04-13) — https://www.hanley.cloud/2023-04-13-Anatomy-of-a-KQL-Query-Part-2/
// Tactics: Discovery
// Platforms: Windows
// Data: SecurityEvent

SecurityEvent                                                                               // <--Define the table to query
| where EventID == "EventID"                                                                // <--Define the EventID to query for
| where Computer == "ThisDevice"                                                            // <--Define the scope (which machine)
| where TimeGenerated >= startofday(ago(1d)) and TimeGenerated <= startofday(now())         // <--Define the time span to query
| summarize count() by bin(TimeGenerated,1d)                                                // <--Return results by frequency per day
| render columnchart                                                                        // <--(Optional) Graph results to chart