To create a query in Microsoft Sentinel (using Kusto Query Language – KQL) that displays the number of daily security alerts over the last 30 days in a timechart, you need to:

Filter the dataset (SecurityAlert) to include only alerts generated in the last 30 days.

Aggregate the number of alerts per provider per day using summarize.

Group those alerts into daily time buckets using bin(TimeGenerated, 1d).

Render the output visually with a timechart.

The correct query structure is:

SecurityAlert

| where TimeGenerated >= ago(30d)

| summarize count() by ProviderName, bin(TimeGenerated, 1d)

| render timechart

summarize → Used to aggregate or count data (e.g., total alerts) by specified fields. In this case, it’s needed to count alerts per provider and per day.

bin → Used to group time-based data into evenly spaced intervals (1 day here) for trend visualization. It aligns timestamps to a fixed period boundary (daily).

lookup → Used to enrich data from another table, not aggregation.

project → Used to select specific columns, not to count or group.

make-series → Also used for time-series data but more suited for generating continuous series (useful for missing data handling). Here, bin is simpler and sufficient.

range → Used to create a sequence of numbers or times manually, not for aggregation.

✅ Final Query Answer:

SecurityAlert

| where TimeGenerated >= ago(30d)

| summarize count() by ProviderName, bin(TimeGenerated, 1d)

| render timechart