Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community
SOLVED

User Events Per Second KQL

Copper Contributor

Hey!

 

I hope you're all doing well!

I've been working with a monthly report with Sentinel and PowerBI - and I've been trying to get a "User EPS Count". This would be a KQL statement that looks at the last 30 days of events, and searches based on a user? For example User1 has an average of 6000 events linked to their account in a month, and User 2 has 3000 events etc. 

 

Is this possible in KQL or do I have to do make a few searches and correlate based around that?

TIA

5 Replies

@CharlieK95 There was a very similar question regarding EPS a while ago (maybe in the last week) so you can find a good query there.

 

As far as mapping the users, you would need to have the MS Sentinel queries auditing feature enabled. Go to this page for more information: Audit Microsoft Sentinel queries and activities | Microsoft Docs

Hi Gary,

Thanks for your response,
I've tried the below, which has brought me the list of users, however I can't quite figure out how to pull their events with them. Is there a way I can make another column in the results, with their events per second, tied to that user account?

SecurityEvent
| where TimeGenerated > ago(1h)
| where TargetAccount has "<customername>"


Many thanks,
C
best response confirmed by CharlieK95 (Copper Contributor)
Solution

Something like this?
SecurityEvent
| where TimeGenerated > ago( 1h)
| summarize EventCount=count() by TargetAccount
| extend EPSCount = EventCount/60/60

Not sure too many single user accounts would be generating so many events to actually get very high EPS, so that last line may be redundant, if you take it out you will just get a count per TargetAccount

Also with SecurityEvent logs in particular, depending on the EventId the TargetAccount field can be blank, maybe just double check you are getting everything you need

Can anybody tell me how can we create any dashboard for "events per second" tiles on dashboard ?

@Vasgauta 

Simply press 'pin' to send the query to a Dashboard or a Workbook - then follow the steps 

Clive_Watson_0-1654761587220.png

 

1 best response

Accepted Solutions
best response confirmed by CharlieK95 (Copper Contributor)
Solution

Something like this?
SecurityEvent
| where TimeGenerated > ago( 1h)
| summarize EventCount=count() by TargetAccount
| extend EPSCount = EventCount/60/60

Not sure too many single user accounts would be generating so many events to actually get very high EPS, so that last line may be redundant, if you take it out you will just get a count per TargetAccount

Also with SecurityEvent logs in particular, depending on the EventId the TargetAccount field can be blank, maybe just double check you are getting everything you need

View solution in original post