Create EPSforM365AdvancedTables.txt

guguji666666 · Dec 6, 2021 · 441523a · 441523a
1 parent a60e26b
commit 441523a
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/EPSforM365AdvancedTables.txt b/EPSforM365AdvancedTables.txt
@@ -0,0 +1,10 @@
+//Getting average EPS and estimated GB per table for the M365 Advanced tables. Run this in Advanced Hunting at security.microsoft.com
+
+
+let bytes_ = 500;
+union withsource=MDTables*
+| where Timestamp > startofday(ago(1d))
+| summarize count() by bin(Timestamp, 1m), MDTables
+| extend EPS = count_ /60
+|summarize avg(EPS), estimatedGBytes = (avg(EPS) * bytes_ ) / (1024*1024*1024) by MDTables
+| sort by toint(estimatedGBytes) desc