KQL to count current enabled, disabled analytic rules
Hi, Would like some help in an KQL query to count the number of enabled and disabled analytic rules for entry into a workbook. Plus a simple count of connected data connectors so the number reflects the overview number and not all the enabled data types. Many thanks, Tim
Fill zero in the table for timechart
Hi, I would like to create a timechart for high daily number of incident in the past 7-day. However, not everyday has high incident. How could I fill the 0 into the result if that day has no high incident? I had the similar ticket before: https://techcommunity.microsoft.com/t5/microsoft-sentinel/barchart-when-the-returned-result-is-zero/m-p/3219799#M9144 I am not sure if i need to create the dynamic object for the past 7-day. Thanks. SecurityIncident | where Severity == "High" | summarize StartTime = startofday(min(TimeGenerated)), count() by Severity, IncidentNumber | summarize count() by bin(StartTime,1d)
Run LogicApp from workbook
Hello, Is there a way to run logic app manually from workbook using url or ARM action with passing parameters to that logic app. Update : I tried using ARM Action and configure ARM action path as following /subscriptions/<>/resourceGroups/<>/providers/Microsoft.Logic/workflows/<>/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=****** But got POST Failed Error !
