KQL SQL - razmipatel/Random GitHub Wiki

AzureDiagnostics | where Category == "SQLSecurityAuditEvents" | project TimeGenerated, server_principal_name_s, statement_s, action_name_s, succeeded_s, client_ip_s

AuditLogs | where action_name_s == "DATABASE LOGIN" | project time_generated_t, server_principal_name_s, succeeded_s, client_ip_s