mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
11 lines
510 B
Plaintext
11 lines
510 B
Plaintext
SigninLogs
|
|
| where TimeGenerated > ago(1d)
|
|
| extend locationString = strcat(tostring(LocationDetails["countryOrRegion"]), "/",
|
|
tostring(LocationDetails["state"]), "/", tostring(LocationDetails["city"]), ";")
|
|
| extend Day = format_datetime(TimeGenerated, "yyyy-MM-dd")
|
|
| summarize LocationList = make_set(locationString),
|
|
LocationCount = dcount(locationString),
|
|
DistinctSourceIp = dcount(IPAddress),
|
|
LogonCount = count()
|
|
by Day, AppDisplayName, UserPrincipalName
|