Which Eventid Fires The Most In A Month

Noisiest Event IDs across the last month — good for spotting new noise sources.

KQL Library  /  Hunting

 Hunting Eventid Forensics which-eventid-fires-the-most-in-a-month.kql

Noisiest Event IDs across the last month — good for spotting new noise sources.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Ever wonder which Event IDs bring the most noise?

SecurityEvent                       // <--Define the table to query
| where TimeGenerated > ago(30d)    // <--Query the last 30 days
| summarize count() by EventID      // <--Return number of hits per EventID
| sort by count_ desc               // <--Bring heaviest hitters to the top
| take 10                           // <--Take the top 10
| render columnchart                // <--Helps visualize which EventIDs are the heavy hitters