Untitled

mail@pastecode.io avatar
unknown
plain_text
2 months ago
340 B
4
Indexable
Never
DeviceInfo
| join kind=leftouter (
    DeviceLogonEvents
    | summarize LastLogon = max(EventTime) by DeviceId
) on DeviceId
| join kind=leftouter (
    DeviceNetworkInfo
    | summarize MappedDrives = make_set(LocalPath) by DeviceId
) on DeviceId
| project DeviceName = DeviceName, LoggedOnUser = LoggedOnUserName, MappedDrives
Leave a Comment