"Suspicious number of resource creation or deployment activities" - Githubissues

wagov / WASOCAutomationPlaybook

For testing playbooks

1 stars 2 forks source link

"Suspicious number of resource creation or deployment activities" #51

Closed DGOV-Bryce closed 1 year ago

DGOV-Bryce commented 1 year ago

The KQL in Action 2 should have "Search" changed to "search".
Further, this KQL can be optimised to simply:
```
search "<entity>"
| summarize count() by $table
```
(On a quick test 24 hour data set this improved from 58s > 9s to retrieve results)

Dinindu-Wick commented 1 year ago

Updated the KQL to reflect the changes.