ADAssessmentRecommendation 表的查询

有关在 Azure 门户中使用这些查询的信息，请参阅 Log Analytics 教程。 有关 REST API，请参阅查询。

计数各重点领域的所有 AD 建议。

ADAssessmentRecommendation 
| summarize AggregatedValue = count() by FocusArea  

计数各计算机的失败结果相关 AD 建议。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Computer

计数各林的失败结果相关 AD 建议。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Forest

计数各域的失败结果相关 AD 建议。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Domain

计数各域控制器的失败结果相关 AD 建议。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by DomainController

计数各受影响对象类型的失败结果相关 AD 建议。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by AffectedObjectType

计数各建议的失败结果相关 AD 建议。

ADAssessmentRecommendation 
| where RecommendationResult == "Failed" 
| summarize AggregatedValue = count() by Recommendation

各建议 ID 的失败结果相关最新高优先级安全建议。

ADAssessmentRecommendation
| where FocusArea == 'Security and Compliance' and RecommendationResult == 'Failed' and RecommendationScore>=35
| summarize arg_max(TimeGenerated, *) by RecommendationId