Initial commit: KQL ↔ SDL PowerQuery proof of equivalence

2026-06-08 21:27:09 +00:00 · 2026-06-01 09:57:14 +02:00
commit 23cbaa9c08
91 changed files with 5966 additions and 0 deletions
@@ -0,0 +1,9 @@
+SecurityEvent
+| where TimeGenerated > ago(1d)
+| where EventID == 4688
+| summarize Count = count(),
+            DistinctComputers = dcount(Computer),
+            DistinctAccounts = dcount(Account),
+            DistinctParent = dcount(ParentProcessName),
+            NoofCommandLines = dcount(CommandLine)
+    by NewProcessName