Initial commit: KQL ↔ SDL PowerQuery proof of equivalence

2026-06-11 14:31:16 +00:00 · 2026-06-01 09:57:14 +02:00
commit 23cbaa9c08
91 changed files with 5966 additions and 0 deletions
@@ -0,0 +1,9 @@
+let timeframe = 1d; let lookback = 7d;
+let Recent = SigninLogs | where TimeGenerated > ago(timeframe) | where ResultType == 0;
+let Baseline = SigninLogs
+  | where TimeGenerated between(ago(lookback + timeframe) .. ago(timeframe))
+  | where ResultType == 0
+  | summarize by AppDisplayName, UserAgent;
+Recent
+| join kind=leftanti Baseline on AppDisplayName, UserAgent
+| project TimeGenerated, UserPrincipalName, AppDisplayName, UserAgent