KQL Search

Query Details

Workbook Creation

Query

//

CloudAppEvents
| where ActionType == "Write Workbooks"
| project AccountDisplayName, IPAddress, DeviceType, ISP, City, CountryCode

Explanation

This query is looking at a dataset called CloudAppEvents and filtering for events where the ActionType is "Write Workbooks". It then selects specific columns from the dataset including AccountDisplayName, IPAddress, DeviceType, ISP, City, and CountryCode.