Untitled

 avatar
unknown
plain_text
a year ago
344 B
3
Indexable
DeviceInfo
| join kind=leftouter (
    DeviceLogonEvents
    | summarize LastLogon = max(TimeGenerated) by DeviceId
) on DeviceId
| join kind=leftouter (
    DeviceNetworkInfo
    | summarize MappedDrives = make_set(LocalPath) by DeviceId
) on DeviceId
| project DeviceName = DeviceName, LoggedOnUser = LoggedOnUserName, MappedDrives
Editor is loading...
Leave a Comment