Forum Discussion
Solved
Microsoft Sentinel - See collected Event IDs per Computer
Hey! Whilst the Common Security Events (via AMA) collects a set number of Windows Security Event IDs: https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference I...
An alternative method
SecurityEvent | summarize count_=dcount(EventID), Ids_=make_set(EventID) by Computer
This might be the answer:
Security Event
| distinct Computer, EventID
Security Event
| distinct Computer, EventID
An alternative method
SecurityEvent
| summarize count_=dcount(EventID), Ids_=make_set(EventID) by Computer
- That is much neater than having to stitch the data together! Thank you.