How Many Times Does This Eventid Fire From This Machine

Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

KQL Library  /  Hunting

 Hunting Eventid Forensics how-many-times-does-this-eventid-fire-from-this-machine.kql

Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
//How Many Times Has This Machine Thrown This Event Today?

SecurityEvent                                                                               // <--Define the table to query
| where EventID == "EventID"                                                                // <--Define the EventID to query for
| where Computer == "ThisDevice"                                                            // <--Define the scope (which machine)
| where TimeGenerated >= startofday(ago(1d)) and TimeGenerated <= startofday(now())         // <--Define the time span to query
| summarize count() by bin(TimeGenerated,1d)                                                // <--Return results by frequency per day
| render columnchart                                                                        // <--(Optional) Graph results to chart