Name	Name	Last commit message	Last commit date
Latest commit History 75 Commits
AR-CloudShellExecution.txt	AR-CloudShellExecution.txt
ActiveIncidents.txt	ActiveIncidents.txt
AddedorAssignedGlobalAdministratorroleperms.txt	AddedorAssignedGlobalAdministratorroleperms.txt
AdminConsent.txt	AdminConsent.txt
AgentedDevicesnotADJoined.txt	AgentedDevicesnotADJoined.txt
AnalyticsRulesRunbyTimes.txt	AnalyticsRulesRunbyTimes.txt
Azure Runbooks query with correlation.txt	Azure Runbooks query with correlation.txt
BillableDatabyDataType.txt	BillableDatabyDataType.txt
Billabledatavolumebydatatype.txt	Billabledatavolumebydatatype.txt
Billabledatavolumebysolution.txt	Billabledatavolumebysolution.txt
BookMarkUpdatedBy.txt	BookMarkUpdatedBy.txt
BookmarkUpdate.txt	BookmarkUpdate.txt
BookmarksCreatedBy.txt	BookmarksCreatedBy.txt
BreakGlassAccount.txt	BreakGlassAccount.txt
BrowserActivitybyGEO.txt	BrowserActivitybyGEO.txt
CEFDevices.txt	CEFDevices.txt
Check4LockedoutUser.txt	Check4LockedoutUser.txt
CloudShell.txt	CloudShell.txt
Cloudshell2.txt	Cloudshell2.txt
Conditional access changes new value and old value.txt	Conditional access changes new value and old value.txt
CostperEventID.txt	CostperEventID.txt
CountriesWhereAgentedComputersReportFrom.txt	CountriesWhereAgentedComputersReportFrom.txt
Cross resource query.txt	Cross resource query.txt
DataByProvider.txt	DataByProvider.txt
Debugging authentication sign-ins.txt	Debugging authentication sign-ins.txt
DirectAgent.txt	DirectAgent.txt
DirectReport.txt	DirectReport.txt
Does a table exist.txt	Does a table exist.txt
DomainAdminsEnterpriseAdmins.txt	DomainAdminsEnterpriseAdmins.txt
Duration of session.txt	Duration of session.txt
EventIDsinLastDay.txt	EventIDsinLastDay.txt
EventLogSources.txt	EventLogSources.txt
GetTags.txt	GetTags.txt
ImpossibleTravelKQL.txt	ImpossibleTravelKQL.txt
Incidents.txt	Incidents.txt
Intune-AutoPilotFailedEnrollment1Day.txt	Intune-AutoPilotFailedEnrollment1Day.txt
Intune-DeviceThreatLevelnotSecured.txt	Intune-DeviceThreatLevelnotSecured.txt
IntuneActivityTypes.txt	IntuneActivityTypes.txt
IntuneAuditEvents.txt	IntuneAuditEvents.txt
IntuneAuditEventsTrend.txt	IntuneAuditEventsTrend.txt
IntuneComplianceFailuresbyOperatingSystem.txt	IntuneComplianceFailuresbyOperatingSystem.txt
IntuneComplianceFailuresbyReason.txt	IntuneComplianceFailuresbyReason.txt
IntuneCountofSuccessfulEnrollmentsbyOS.txt	IntuneCountofSuccessfulEnrollmentsbyOS.txt
IntuneDevicesNotinCompliance.txt	IntuneDevicesNotinCompliance.txt
IntuneEnrollmentEventsTrend.txt	IntuneEnrollmentEventsTrend.txt
IntuneEnrollmentFailurereasons.txt	IntuneEnrollmentFailurereasons.txt
IntuneEnrollmentFailuresbyEnrollmentType.txt	IntuneEnrollmentFailuresbyEnrollmentType.txt
IntuneEnrollmentFailuresbyPlatform.txt	IntuneEnrollmentFailuresbyPlatform.txt
IntuneEnrollmentStatistics.txt	IntuneEnrollmentStatistics.txt
IntuneEnrollmentSuccessbyEnrollmentType.txt	IntuneEnrollmentSuccessbyEnrollmentType.txt
IntuneNotCompliant.txt	IntuneNotCompliant.txt
< 10000 a title="IntuneNotCompliant2.txt" aria-label="IntuneNotCompliant2.txt, (File)" class="Link--primary" href="/jeswanthm/SentinelKQL/blob/master/IntuneNotCompliant2.txt" data-discover="true">IntuneNotCompliant2.txt	IntuneNotCompliant2.txt
IntuneRecentEventsbyAccounts.txt	IntuneRecentEventsbyAccounts.txt
IntuneRemoteactionsbyactiontype.txt	IntuneRemoteactionsbyactiontype.txt
IntuneRemoteactionstopusers.txt	IntuneRemoteactionstopusers.txt
IntuneSuccessfulSynchedDevice.txt	IntuneSuccessfulSynchedDevice.txt
IntuneSummarizebyOperation.txt	IntuneSummarizebyOperation.txt
IntuneTopuserswithauditedactions.txt	IntuneTopuserswithauditedactions.txt
Intunecomputershutdowns.txt	Intunecomputershutdowns.txt
IntuneisCompliantByOSandOSVersion.txt	IntuneisCompliantByOSandOSVersion.txt
LAG analysis example.txt	LAG analysis example.txt
Language demo just for fun and demo pattern replace.txt	Language demo just for fun and demo pattern replace.txt
Latency for a Log Analytics example with rolling percentiles.txt	Latency for a Log Analytics example with rolling percentiles.txt
LineNumbers-serialize.txt	LineNumbers-serialize.txt
LookingforInstalledKBIDs.txt	LookingforInstalledKBIDs.txt
Make series to fill in gaps with default for bin by bucket.txt	Make series to fill in gaps with default for bin by bucket.txt
Make-series for gaps.txt	Make-series for gaps.txt
NSGChangesByUser.txt	NSGChangesByUser.txt
NSGChangesbyUserandResource.txt	NSGChangesbyUserandResource.txt
NewBruteForceAttacks.txt	NewBruteForceAttacks.txt
NotEqual.txt	NotEqual.txt
PowerShellExecution.txt	PowerShellExecution.txt
README.md	README.md
Running total aka cumulative sum.txt	Running total aka cumulative sum.txt
SMA and EMA examples.txt	SMA and EMA examples.txt
SecurityIndicentsCreatedinLastDay.txt	SecurityIndicentsCreatedinLastDay.txt
SentinelIncidentURLs- ALL.txt	SentinelIncidentURLs- ALL.txt
SharePointDownloads.txt	SharePointDownloads.txt
SigninLogsByBrowserandLocation.txt	SigninLogsByBrowserandLocation.txt
SigninLogsByDay - parsing UTC.txt	SigninLogsByDay - parsing UTC.txt
SophosDisabled.txt	SophosDisabled.txt
SuccessfulRoleAssignments.txt	SuccessfulRoleAssignments.txt
SystemsReportingtoSentinel.txt	SystemsReportingtoSentinel.txt
SystemthatHaveUpdatedintheLast4Hours.txt	SystemthatHaveUpdatedintheLast4Hours.txt
TimeBetweenDates.txt	TimeBetweenDates.txt
Top N by Group example via top-nested - option 2.txt	Top N by Group example via top-nested - option 2.txt
Top N by group example via LAG - option 1.txt	Top N by group example via LAG - option 1.txt
Tracking Privileged Account Rare Activity without AWS.txt	Tracking Privileged Account Rare Activity without AWS.txt
UpdateDataConnectors.txt	UpdateDataConnectors.txt
UserAccountLockedAAD.txt	UserAccountLockedAAD.txt
WhoDeletedAlertRule.txt	WhoDeletedAlertRule.txt
WiresharkRSSTraffic.txt	WiresharkRSSTraffic.txt
acrossworkspaceforFunction.txt	acrossworkspaceforFunction.txt
adminskql.txt	adminskql.txt
allreportingcomputers.txt	allreportingcomputers.txt
computersendingmostsecurityalerts.txt	computersendingmostsecurityalerts.txt
computersunhealthystate.txt	computersunhealthystate.txt
dataparser.txt	dataparser.txt
dataproviders.txt	dataproviders.txt
devices.txt	devices.txt

Name

Last commit message

Last commit date

AR-CloudShellExecution.txt

ActiveIncidents.txt

AddedorAssignedGlobalAdministratorroleperms.txt

AdminConsent.txt

AgentedDevicesnotADJoined.txt

AnalyticsRulesRunbyTimes.txt

Azure Runbooks query with correlation.txt

BillableDatabyDataType.txt

Billabledatavolumebydatatype.txt

Billabledatavolumebysolution.txt

BookMarkUpdatedBy.txt

BookmarkUpdate.txt

BookmarksCreatedBy.txt

BreakGlassAccount.txt

BrowserActivitybyGEO.txt

CEFDevices.txt

Check4LockedoutUser.txt

CloudShell.txt

Cloudshell2.txt

Conditional access changes new value and old value.txt

CostperEventID.txt

CountriesWhereAgentedComputersReportFrom.txt

Cross resource query.txt

DataByProvider.txt

Debugging authentication sign-ins.txt

DirectAgent.txt

DirectReport.txt

Does a table exist.txt

DomainAdminsEnterpriseAdmins.txt

Duration of session.txt

EventIDsinLastDay.txt

EventLogSources.txt

GetTags.txt

ImpossibleTravelKQL.txt

Incidents.txt

Intune-AutoPilotFailedEnrollment1Day.txt

Intune-DeviceThreatLevelnotSecured.txt

IntuneActivityTypes.txt

IntuneAuditEvents.txt

IntuneAuditEventsTrend.txt

IntuneComplianceFailuresbyOperatingSystem.txt

IntuneComplianceFailuresbyReason.txt

IntuneCountofSuccessfulEnrollmentsbyOS.txt

IntuneDevicesNotinCompliance.txt

IntuneEnrollmentEventsTrend.txt

IntuneEnrollmentFailurereasons.txt

IntuneEnrollmentFailuresbyEnrollmentType.txt

IntuneEnrollmentFailuresbyPlatform.txt

IntuneEnrollmentStatistics.txt

IntuneEnrollmentSuccessbyEnrollmentType.txt

IntuneNotCompliant.txt

< 10000 a title="IntuneNotCompliant2.txt" aria-label="IntuneNotCompliant2.txt, (File)" class="Link--primary" href="/jeswanthm/SentinelKQL/blob/master/IntuneNotCompliant2.txt" data-discover="true">IntuneNotCompliant2.txt

IntuneNotCompliant2.txt

IntuneRecentEventsbyAccounts.txt

IntuneRemoteactionsbyactiontype.txt

IntuneRemoteactionstopusers.txt

IntuneSuccessfulSynchedDevice.txt

IntuneSummarizebyOperation.txt

IntuneTopuserswithauditedactions.txt

Intunecomputershutdowns.txt

IntuneisCompliantByOSandOSVersion.txt

LAG analysis example.txt

Language demo just for fun and demo pattern replace.txt

Latency for a Log Analytics example with rolling percentiles.txt