KQL_Intune

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #go #machine-learning #docker #windows #awesome #cli #awesome-list #pytorch #ios #open-source

(★ 94)

No description available.

KQL_Intune Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Welcome!

[![Twitter Follow](https://img.shields.io/badge/Twitter-1DA1F2?style=for-the-badge&logo=twitter&logoColor=white)](https://twitter.com/UgurKocDe/) [![LinkedIn](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/ugur-koc-302b9817a/) [![Website](https://img.shields.io/badge/website-000000?style=for-the-badge&logo=About.me&logoColor=white)](https://ugurkoc.de)

The goal of this repository is to share awesome KQL Queries that will help every Intune Administrator to filter for relevant informations and also present the data visually to interested parties in the form of a Azure Workbook.

This collection of KQL Querries include some of which I have created because there was a neccessitiy or use case for it. Other queries are from the Community that I found particulary interisting and worth to share. The ones from the community will also contain the weblink to the source and author.

Please feel free to share any feedback and suggestions on Twitter @ugurkocde!

-------------
  * [What is KQL?](#what-is-kql-)
  * [How to get started with KQL and Intune](#how-to-get-started-with-kql-and-intune-)
  * [How to use the queries in this repository](#How-to-use-the-queries-in-this-repository)
  * [Categories](#Categories)
  * [Audit (IntuneAuditLogs)](#audit-(intuneauditlogs)-)
  * [Compliance (IntuneDeviceComplianceOrg)](#compliance-(intunedevicecomplianceorg)-)
  * [Device (IntuneDevices)](#device-(intunedevices)-)
  * [Operational (IntuneOperationalLogs)](#operational-(intuneoperationallogs)-)
  * [Useful Links from Microsoft and the Community for further deep-dive](#useful-links-from-microsoft-and-the-community-for-further-deep-dive-)

-------------

# What is KQL?

Kusto Query Language is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, and more. The query uses schema entities that are organized in a hierarchy similar to SQL's: databases, tables, and columns.

A Kusto query is a read-only request to process data and return results. The request is stated in plain text, using a data-flow model that is easy to read, author, and automate. Kusto queries are made of one or more query statements.

Source: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/

# How to get started with KQL and Intune

Use the steps described on the following website to Connect your Endpoint Manager (Intune) with a Log Analytics Workspace to get started: https://shehanperera.com/2022/05/22/loganalytics-endpointmanager1/

![Image](https://shehanstechblog.files.wordpress.com/2022/05/image-46.png)

# How to use the queries in this repository

After you configured and enabled the option to send Data from Intune to your Log Analytics Workspace, you can go to Azure -> Log Analytics Workspace -> Logs and copy paste the query you want to test.

# Categories

I have created different categories (folders) based on the data tables from Intune to help you find the queries you want:

1. Audit
2. Compliance
3. Device
4. Operational

The data tables include the following informations:

## Audit (IntuneAuditLogs)

## Compliance (IntuneDeviceComplianceOrg)

## Device (IntuneDevices)

## Operational (IntuneOperationalLogs)

# Useful Links from Microsoft and the Community for further deep-dive

MustLearnKQL from Rod Trent
More KQL Queries: https://github.com/rod-trent/MustLearnKQL and the Book (PDF): https://github.com/rod-trent/MustLearnKQL/blob/main/Book_Version/MustLearnKQL_Book.pdf

More Example Queries:
https://github.com/reprise99/Sentinel-Queries
https://github.com/rod-trent/SentinelKQL

KQL_Intune

KQL_Intune Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

KQL_Intune

KQL_Intune Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README