Queries for the CrowdStrikeAlerts table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Critical alerts by tactic

Returns count of critical alerts grouped by MITRE ATT&CK tactic.

CrowdStrikeAlerts
| where Severity == "Critical"
| summarize count() by TacticId, Tactic
| order by count_ desc