Prepare for SC-200 with a reference that remembers your progress.

Security detections often depend on converting raw events into counts, distinct entities, thresholds, trends, and visual patterns. This module centers on summarize and render.

summarize groups rows and calculates aggregate values. Without a by clause it produces one group; with by, it returns one row per unique grouping combination.

SecurityEvent
| where EventID == 4688
| summarize ProcessStarts = count()
    by Process, Computer

arg_max() and arg_min() return the complete row associated with the maximum or minimum value inside each group.

SecurityEvent
| summarize arg_max(TimeGenerated, *) by Account

Pipeline order is critical. Filtering for Event ID 4624 before arg_max returns each account's latest logon; filtering afterward returns accounts whose latest event of any kind happens to be a logon.

make_list() creates a dynamic JSON array containing all values in a group, including duplicates. make_set() creates an array of distinct values.

SecurityEvent
| where EventID == 4624
| summarize Accounts = make_set(Account)
    by Computer

Arrays are useful for entity context in analytics rules, grouped investigation output, and later expansion with mv-expand.

render converts tabular results into a chart. Supported lesson examples include area, bar, column, pie, scatter, and time charts. Prepare the correct columns with summarize before rendering.

SecurityEvent
| summarize Events = count()
    by bin(TimeGenerated, 1d)
| render timechart

bin() rounds values down to fixed intervals and is fundamental for time-series grouping. Charts support analysis and workbooks; analytics rules still evaluate the tabular query logic.

Review grouping versus filtering, count versus dcount, max versus arg_max, make_list versus make_set, and the relationship among bin, summarize, and render.

Transform event streams into meaningful security evidence by grouping at the right granularity, retaining the correct representative rows, and visualizing only well-shaped results.