Hotspot Question You have an Azure subscription. Azure AD logs are sent to a Log Analytics workspace. You need to query the logs and graphically display the number of sign-ins per user. How should…

Question

Answer Area

• First operator in the query (for count() by Identity)summarize
  extendprintprojectrendersummarize
• Second operator in the query (for columnchart)render
  extendprintprojectrendersummarize

Explanation

This question tests knowledge of KQL (Kusto Query Language) used in Azure Monitor Log Analytics to query Azure AD sign-in logs and render results as a chart showing sign-ins per user.

Approach. The correct KQL query would be: SigninLogs | summarize count() by UserPrincipalName | render barchart. First, you query the 'SigninLogs' table which contains Azure AD sign-in data. Then you use 'summarize count() by UserPrincipalName' to aggregate and count the number of sign-in events grouped by each user. Finally, 'render barchart' (or 'render piechart') is used to graphically display the results as a visualization within Log Analytics. The 'render' operator is the key KQL command that transforms tabular query results into a graphical chart display.

Concept tested. KQL (Kusto Query Language) syntax in Azure Monitor Log Analytics, specifically the use of the SigninLogs table, the 'summarize' operator with count() aggregation grouped by a field, and the 'render' operator to produce graphical visualizations from query results.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-analyze-activity-logs-log-analytics

No community discussion yet for this question.