Field Reference

devices
| list device.name,
       operating_system.name,
       hardware.memory.as(format = bytes),
       last_seen
| limit 50

devices
| where operating_system.name == "Windows 11"
  and hardware.memory > 17179869184
| list device.name,
       hardware.memory.as(format = bytes),
       processor_name,
       department
| sort hardware.memory desc
| limit 100

devices
| where last_seen < ago(7d)
| list device.name,
       last_seen,
       operating_system.name,
       location
| sort last_seen asc
| limit 100

execution.events during past 7d
| where binary.name == "outlook.exe"
| summarize
    avg_cpu = cpu_time.avg(),
    avg_memory = real_memory.avg(),
    total_execution_time = execution_duration.sum()
  by device.name
| list device.name,
       avg_cpu,
       avg_memory.as(format = bytes),
       total_execution_time
| sort avg_cpu desc
| limit 20

execution.events during past 30d
| where binary.name in ["outlook.exe", "teams.exe", "chrome.exe"]
| summarize
    unique_devices = device.count(),
    avg_cpu = cpu_time.avg()
  by 1d, binary.name
| sort start_time asc

execution.crashes during past 7d
| where binary.binary.name == "outlook.exe"
| summarize
    crash_count = count(),
    affected_devices = device.name.count(),
    affected_users = user.name.count()
  by binary.real_binary.version
| list binary.real_binary.version,
       crash_count,
       affected_devices,
       affected_users
| sort crash_count desc
| limit 20

execution.crashes during past 30d
| where application.name == "Microsoft Outlook"
| summarize crash_count = count() by 1d
| sort start_time asc

devices during past 7d
| include device_performance.events
| where cpu_usage.avg > 50
| compute
    avg_cpu = cpu_usage.avg(),
    peak_cpu = cpu_usage.avg.max()
| list device.name,
       avg_cpu.as(format = percent),
       peak_cpu.as(format = percent)
| sort avg_cpu desc
| limit 20

devices during past 7d
| include device_performance.events
| compute free_space_gb = free_disk_space.last() / 1000
| where free_space_gb < 20
| list device.name,
       free_space_gb.as(format = bytes)
| sort free_space_gb asc
| limit 50

connection.events during past 7d
| where event.destination.domain = "*.company.com"
  and event.failed_connection_ratio >= 0.10
| summarize
    total_connections = event.number_of_connections.sum(),
    failed_connections = (event.number_of_no_host_connections.sum() +
                          event.number_of_no_service_connections.sum()),
    avg_failure_rate = event.failed_connection_ratio.avg(),
    affected_devices = device.name.count()
  by event.destination.domain
| list event.destination.domain,
       total_connections,
       avg_failure_rate.as(format = percent),
       affected_devices
| sort avg_failure_rate desc
| limit 20

connection.events during past 7d
| where event.destination.domain = "*.service.com"
| summarize
    avg_rtt = connection_establishment_time.avg(),
    max_rtt = connection_establishment_time.max()
  by event.destination.domain
| list event.destination.domain,
       avg_rtt,
       max_rtt
| sort avg_rtt desc
| limit 20

web.page_views during past 7d
| where application.name == "Salesforce"
| summarize
    avg_load_time = page_load_time.total.avg(),
    max_load_time = page_load_time.total.max(),
    page_count = count()
  by device.name
| list device.name,
       avg_load_time,
       max_load_time,
       page_count
| sort avg_load_time desc
| limit 20

web.page_views during past 7d
| where application.name in ["Salesforce", "Jira", "Confluence"]
| summarize
    avg_backend_time = page_load_time.backend.avg(),
    avg_frontend_time = page_load_time.frontend.avg(),
    page_views = count()
  by application.name
| list application.name,
       avg_backend_time,
       avg_frontend_time,
       page_views
| sort avg_backend_time desc

/* Events from last week show historical OS */
execution.events during past 7d
| list device.name,
       context.os_name,              # Shows "Windows 10" for old events
       device.operating_system.name  # Shows "Windows 11" (current)

/* Current device inventory */
devices
| list device.name,
       device.operating_system.name,  # Current OS
       device.hardware.memory,         # Current RAM
       device.department               # Current dept

devices
| list device.name,
       hardware.memory.as(format = bytes),
       hardware.model,
       number_of_logical_processors,
       volumes.size.as(format = bytes)

connection.events during past 7d
| where event.destination.domain = "*.company.com"
| summarize
    avg_rtt = connection_establishment_time.avg(),
    total_bandwidth = (incoming_traffic.sum() + outgoing_traffic.sum()),
    failure_rate = event.failed_connection_ratio.avg()
  by event.destination.domain

devices during past 7d
| include device_performance.events
| compute
    avg_cpu = cpu_usage.avg(),
    avg_free_memory = free_memory.avg(),
    free_disk_gb = free_disk_space.last() / 1000
| list device.name,
       avg_cpu.as(format = percent),
       avg_free_memory.as(format = bytes),
       free_disk_gb.as(format = bytes)