SecurityEvent

← All KQL categories

Data Source

SecurityEvent

18 queries tagged with this data source.

• Cost & Ingest / Billable Volume GB Per Table

  Ingest volume in GB for a single table (defaults to `SecurityEvent`, swap as needed).

• Cost & Ingest / Cost By Eventid Cost Of Eventid By Computer

  Breaks the cost of a specific Event ID out by originating computer (defaults to `EventID == 4672`).

• Cost & Ingest / Cost By Eventid Cost Of Eventid

  Estimated cost of a single Event ID over a time window, using your effective per-GB rate.

• Cost & Ingest / Cost By Eventid Eventid By Billedsize

  Ingest volume in GB per Event ID from the `SecurityEvent` table.

• Cost & Ingest / Cost By Eventid Top 10 Eventids Windows Securityevents

  Top 10 most expensive Event IDs from the `SecurityEvent` table over the last 90 days.

• Cost & Ingest / Cost By Table Cost Of Workstations Logging Direct To Sentinel

  Find workstations shipping logs directly to Sentinel and estimate what it's costing you.

• Cost & Ingest / Cost By Table Top 10 Security Events With Cost Enhanced

  Top `SecurityEvent` `EventID`s (30d) with GiB, emoji cost-tier, and formatted `$X.XX` string.

• Cost & Ingest / Cost By Table Top 10 Security Events With Cost

  Top `SecurityEvent` `EventID`s with `Activity` (30d) and numeric `CostUSD`.

• Hunting / Eventid Forensics How Many Times Does This Eventid Fire From This Machine

  Count of a specific Event ID from a specific machine, bucketed daily and rendered as a column chart.

• Hunting / Eventid Forensics Which Accounts Are Throwing This Eventid

  Which accounts fire a specific Event ID and how often, per day.

• Hunting / Eventid Forensics Which Devices Are Throwing This Eventid

  Which computers fire a specific Event ID and how often, per day.

• Hunting / Eventid Forensics Which Eventid Fires The Most In A Month

  Noisiest Event IDs across the last month — good for spotting new noise sources.

• Hunting / Eventid Forensics Which Eventids Are Suddenly Acting Weird With Context

  Same deviation analysis as the basic variant, joined with `Computer` and `Account` so you can see which host or user is driving the spike in one shot. Uses a 30-day recent window to reduce join noise.

• Hunting / Eventid Forensics Which Eventids Are Suddenly Acting Weird

  Which Event IDs have recently spiked (7d) versus their 90-day baseline, sorted by deviation ratio. Basic variant — just EventID + counts.

• Hunting / User Activity RDP Logins Per Day Per User

  RDP logins per user per day (30d) rendered as a timechart. Use for baselining "normal" login volume before hunting for anomalies.

• Hunting / User Activity Whos Logging In And When

  Timestamped feed of RDP logon (4624/LogonType 10), logoff (4634), and reconnect/disconnect (4778/4779) events over 30 days.

• Identity Who Deleted An AD User

  Who deleted an AD user (`SecurityEvent` EventID `4726`) over the last 90 days.

• Reference Sort Function Result Comparison

  Side-by-side of `sort by` vs `top` on a cost-per-EventID query, showing that both produce identical results in this case — a small worked example for anyone learning KQL sort semantics.