ASR rules categorized detection graph
This query offers daily categorization of ASR rules, helping SOC analysts monitor specific categories like office-related activities or WMI among the 16 rules. It aids in tracking detection rates and organizational trends.
Microsoft Sentinel (KQL)
