Which Devices are Throwing this EventID?.kql

// Author: Ian D. Hanley | LinkedIn: /in/ianhanley/ | Twitter: @IanDHanley | Github: https://github.com/EEN421 | Blog: Hanley.cloud / DevSecOpsDad.com
// Ever wonder how many times each computer in your environment throws a specific EventID per day?

SecurityEvent                     // <--Define the table to query
| where EventID == "8002"         // <--Declare which EventID you're looking for
| summarize count() by Computer   // <--Show how many times that EventID was thrown per device
| render columnchart              // <--Optional, but helps quickly visualize potential outliers