mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
10 lines
436 B
Plaintext
10 lines
436 B
Plaintext
let timeframe = 1d; let lookback = 7d;
|
|
let Recent = SigninLogs | where TimeGenerated > ago(timeframe) | where ResultType == 0;
|
|
let Baseline = SigninLogs
|
|
| where TimeGenerated between(ago(lookback + timeframe) .. ago(timeframe))
|
|
| where ResultType == 0
|
|
| summarize by AppDisplayName, UserAgent;
|
|
Recent
|
|
| join kind=leftanti Baseline on AppDisplayName, UserAgent
|
|
| project TimeGenerated, UserPrincipalName, AppDisplayName, UserAgent
|