KQL Search

Query Details

Workbook Creation

Query

//

CloudAppEvents
| where ActionType == "Write Workbooks"
| project AccountDisplayName, IPAddress, DeviceType, ISP, City, CountryCode

Explanation

This query is looking at a dataset called CloudAppEvents and filtering for events where the ActionType is "Write Workbooks". It then selects specific columns from the dataset including AccountDisplayName, IPAddress, DeviceType, ISP, City, and CountryCode.

Details

Rod Trent profile picture

Rod Trent

Released: April 6, 2022

Tables

CloudAppEvents

Keywords

CloudAppEventsActionTypeWrite WorkbooksAccountDisplayNameIPAddressDeviceTypeISPCityCountryCode

Operators

| where AccountDisplayName contains "John" | summarize count() by City | order by count_ desc | take 5

Actions

GitHub