Which Accounts Are Throwing This Eventid

Which accounts fire a specific Event ID and how often, per day.

KQL Library  /  Hunting

 Hunting Eventid Forensics which-accounts-are-throwing-this-eventid.kql

Which accounts fire a specific Event ID and how often, per day.

Tactics Discovery
Platforms Windows
Data SecurityEvent
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Ever wonder how many times each account in your environment throws a specific EventID per day?
// Source: KQL Toolbox #3: Which Event ID Noises Up Your Logs (and Who’s Causing It)? (2026-01-10) — https://www.hanley.cloud/2026-01-10-KQL-Toolbox-3-Which-Event-ID-Noises-Up-Your-Logs-%28and-Who-s-Causing-It%29/
// Tactics: Discovery
// Platforms: Windows
// Data: SecurityEvent

SecurityEvent                     // <--Define the table to query
| where EventID == "4662"         // <--Declare which EventID you're looking for
| summarize count() by Account    // <--Show how many times that EventID was thrown per account
| render columnchart              // <--Optional, but helps quickly visualize potential outliers