Mitre Attack Techniques Observed

Events mapped against MITRE ATT&CK Techniques that have been observed in the environment, with percentage of total.

KQL Library  /  MITRE ATT&CK

 MITRE ATT&CK mitre-attack-techniques-observed.kql

Events mapped against MITRE ATT&CK Techniques that have been observed in the environment, with percentage of total.

Platforms Microsoft Sentinel
Data SecurityAlert
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This query identifies events mapped against the MITRE ATT&CK Matrix that have been observed in the environment
// Source: KQL Toolbox #7: From Detection Coverage To Response Reality (2026-02-08) — https://www.hanley.cloud/2026-02-08-KQL-Toolbox-7-From-Detection-Coverage-to-Response-Reality/
// Platforms: Microsoft Sentinel
// Data: SecurityAlert

let TotalCount = toscalar(
    SecurityAlert
    | where TimeGenerated > ago(90d)
    | where isnotempty(Techniques)
    | mv-expand technique = split(Techniques, ", ")
    | summarize TotalCount = count()
    );
SecurityAlert
| where TimeGenerated > ago(90d)
| where isnotempty(Techniques)
| mv-expand technique = split(Techniques, ", ")
| summarize Count = count() by tostring(technique)
| extend Percentage = strcat(round(Count * 100.0 / TotalCount, 2), '%')
| sort by Count desc
| top 10 by Count
| project ["MITRE Technique"] = technique, Count, Percentage