Initial commit: KQL ↔ SDL PowerQuery proof of equivalence

kql/04_daily_signin_location_trend.kql

@@ -0,0 +1,10 @@
+SigninLogs
+| where TimeGenerated > ago(1d)
+| extend locationString = strcat(tostring(LocationDetails["countryOrRegion"]), "/",
+        tostring(LocationDetails["state"]), "/", tostring(LocationDetails["city"]), ";")
+| extend Day = format_datetime(TimeGenerated, "yyyy-MM-dd")
+| summarize LocationList = make_set(locationString),
+            LocationCount = dcount(locationString),
+            DistinctSourceIp = dcount(IPAddress),
+            LogonCount = count()
+    by Day, AppDisplayName, UserPrincipalName