Reporting

 KQL Library / Reporting

Reporting

Periodic-summary queries for stakeholder reporting — weekly, monthly, or quarterly. The "here's what happened this period and what changed" view.

← All KQL categories

• Alert Trends alert-trends.kql

  Alerts with significant increases vs the previous 90-day period, with severity categorized.

• Data Sources With Biggest Delta In Log Volume data-sources-with-biggest-delta-in-log-volume.kql

  Data sources with the biggest log-volume delta between comparison periods — configurable tunables at the top of the query.

• Report Queries report-queries.kql

  Grab-bag of reporting queries starting with MTTR against `SecurityIncident`.