如何在sentinel中编写Kusto查询以获取上个月的日志?

Question

| where TimeGenerated > ago(30d)只给我最近30天的日志，我正在搜索查询以从表中获取上个月的日志，因此我可以直接将其导出到Power BI。

Answer 1

你可以这样做。我展示了两种方式。最简单的方法就是把这个月的日期硬塞进去。更难的方法需要使用make_datetime函数。

// The Easy 'Manual' Way
AuditLogs
| where TimeGenerated >= datetime('2021-08-01') and TimeGenerated <= datetime('2021-08-31')
// Automated Way
let lastmonth = getmonth(datetime(now)) -1;
let year = getyear(datetime(now)); 
let monthEnd = endofmonth(datetime(now),-1); 
AuditLogs
| where TimeGenerated >= make_datetime(year,lastmonth,01) and TimeGenerated <= monthEnd

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/make-datetimefunction

Answer 2

只是想添加到@Ken W MSFT的伟大查询，通过建议这个自动化

let time_start = startofmonth(datetime(now)， -1);Let time_end = endofmonth(datetime(now)，-1);AuditLogswhere TimeGenerated between (time_start ..)time_end)