kqlHunting

Onboarded Machines by Resource Group

This query lists the amount of onboarded Azure Arc Machines for each resourceGroup.

Detection Query

arg("").Resources
| where type == "microsoft.hybridcompute/machines"
| summarize Total = dcount(id), SampleDevices = make_set(name, 10) by resourceGroup

Platforms

azure-sentinel

Tags

azure

Raw Content

# Onboarded Machines by Resource Group

## Query Information

#### Description
This query lists the amount of onboarded Azure Arc Machines for each resourceGroup.

## Sentinel
```KQL
arg("").Resources
| where type == "microsoft.hybridcompute/machines"
| summarize Total = dcount(id), SampleDevices = make_set(name, 10) by resourceGroup
```