[Query] show me all total count of unique ITDR tenants that have generated at least 1 event in the last 24 hours
M
Matti Zayas
Copy and paste in SIEM search bar
SELECT arrayDistinct(groupArrayIf(ecs_fields['itdr.TenantId'], mapContains(ecs_fields, 'itdr.TenantId'))) AS unique_tenants FROM new_logs AS logs WHERE new_logs.account_id = 26290 AND new_logs.uuid >= '019fd5b9-88b0-7000-8000-000000000000' AND new_logs.uuid < '019fd695-42b0-7000-8000-000000000000' LIMIT 50001