Untitled

Heartbeat
| where TimeGenerated > ago(7d)
| distinct Computer
| extend Status = iff(Computer in (
    (VMConnection | where TimeGenerated > ago(7d) | distinct Computer)
), "Active with VMConnection", "No VMConnection Data")
| join kind=leftouter (
    Heartbeat
    | summarize 
        LastHeartbeat = max(TimeGenerated), 
        TotalHeartbeats = count() 
    by Computer
) on Computer
| join kind=leftouter (
    VMConnection
    | summarize 
        LastVMConnection = max(TimeGenerated), 
        TotalConnections = count() 
    by Computer
) on Computer
| project 
    Computer, 
    Status, 
    LastHeartbeat, 
    TotalHeartbeats, 
    LastVMConnection, 
    TotalConnections
| order by 
    Status, 
    LastHeartbeat desc