Which Eventid Fires The Most In A Month

Noisiest Event IDs across the last month — good for spotting new noise sources.

KQL Library  /  Hunting

 Hunting Eventid Forensics which-eventid-fires-the-most-in-a-month.kql

Noisiest Event IDs across the last month — good for spotting new noise sources.

Tactics Discovery
Platforms Windows
Data SecurityEvent
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Ever wonder which Event IDs bring the most noise?
// Source: KQL Toolbox #3: Which Event ID Noises Up Your Logs (and Who’s Causing It)? (2026-01-10) — https://www.hanley.cloud/2026-01-10-KQL-Toolbox-3-Which-Event-ID-Noises-Up-Your-Logs-%28and-Who-s-Causing-It%29/
// Tactics: Discovery
// Platforms: Windows
// Data: SecurityEvent

SecurityEvent                       // <--Define the table to query
| where TimeGenerated > ago(30d)    // <--Query the last 30 days
| summarize count() by EventID      // <--Return number of hits per EventID
| sort by count_ desc               // <--Bring heaviest hitters to the top
| take 10                           // <--Take the top 10
| render columnchart                // <--Helps visualize which EventIDs are the heavy hitters