Forum Discussion
User Events Per Second KQL
Something like this?
SecurityEvent
| where TimeGenerated > ago( 1h)
| summarize EventCount=count() by TargetAccount
| extend EPSCount = EventCount/60/60
Not sure too many single user accounts would be generating so many events to actually get very high EPS, so that last line may be redundant, if you take it out you will just get a count per TargetAccount
Also with SecurityEvent logs in particular, depending on the EventId the TargetAccount field can be blank, maybe just double check you are getting everything you need
CharlieK95 There was a very similar question regarding EPS a while ago (maybe in the last week) so you can find a good query there.
As far as mapping the users, you would need to have the MS Sentinel queries auditing feature enabled. Go to this page for more information: Audit Microsoft Sentinel queries and activities | Microsoft Docs
Thanks for your response,
I've tried the below, which has brought me the list of users, however I can't quite figure out how to pull their events with them. Is there a way I can make another column in the results, with their events per second, tied to that user account?
SecurityEvent
| where TimeGenerated > ago(1h)
| where TargetAccount has "<customername>"
Many thanks,
C
Something like this?
SecurityEvent
| where TimeGenerated > ago( 1h)
| summarize EventCount=count() by TargetAccount
| extend EPSCount = EventCount/60/60
Not sure too many single user accounts would be generating so many events to actually get very high EPS, so that last line may be redundant, if you take it out you will just get a count per TargetAccount
Also with SecurityEvent logs in particular, depending on the EventId the TargetAccount field can be blank, maybe just double check you are getting everything you need