Forum Discussion
JMSHW0420
Apr 07, 2023Iron Contributor
RE: KQL query for event types per table used by Microsoft Sentinel (and connected Data Connectors)
So with a base KQL query of: union withsource= table * ...is there a way to query each table in Microsoft Sentinel and identify each EVENT type used within it? So listed as... Table 1...
Clive_Watson
Apr 11, 2023Bronze Contributor
By "Event Type" are you referring to the EventID or something else? Maybe just a count of rows in each Table? A screenshot of teh data you are referring to would help. Thanks