Which Devices Are Throwing This Eventid

Which computers fire a specific Event ID and how often, per day.

KQL Library  /  Hunting

 Hunting Eventid Forensics which-devices-are-throwing-this-eventid.kql

Which computers fire a specific Event ID and how often, per day.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Ever wonder how many times each computer in your environment throws a specific EventID per day?

SecurityEvent                     // <--Define the table to query
| where EventID == "8002"         // <--Declare which EventID you're looking for
| summarize count() by Computer   // <--Show how many times that EventID was thrown per device
| render columnchart              // <--Optional, but helps quickly visualize potential outliers