log-analytics.md

Log Analytics examples

Across all data types

Chart the record-count per table in the last 5 hours

Count all logs collected over the last hour, per type

No specific data type

Calculate the duration of a reported state, logged continuously

Exclude a range of IPs from results

AzureDiagnostics

Count Azure diagnostics records per category

Get a random record for each unique category

Get the latest record per category

Usage

Calculate the average size of perf usage reports per computer

Timechart latency percentiles 50 and 95

Usage of computer today

Heartbeat

Chart a week-over-week view of the number of computers sending data

Find stale computers

Get the latest heartbeat record per computer IP

Match protection and heartbeat records

Calculate availability rate for connected servers

Updates

Computers still missing updates

ProtectionStatus

Computers with non-reporting protection status duration

Match protection and heartbeat records

NetworkMonitoring

Computers with unhealthy latency

Perf

Correlate computer memory and CPU

Perf CPU Utilization graph per computer

Alert

Count alerts by severity per day

Get a numbered list of the latest alerts

SecurityEvent

Count security events by activity ID

Count security events related to permissions

Find accounts that failed to logon from computers on which we identify a security detection

Is my security data available

Parse activity name and ID

Processes that used explicit credentials

Top 5 running processes in the last 3 days

Find repeating failed login attempts by the same account from different IPs

Find user accounts that failed to login over 5 times in 1 day

Event

Search application-level events described as Cryptographic

Search events related to unmarshaling