Explanation:

To combine sign-in attempts from endpoints and on-premises AD DS domain controllers in Microsoft 365 Defender advanced hunting, you should query the tables that record those events and union them.
DeviceLogonEvent s contains interactive and network logon activity collected from devices onboarded to Microsoft Defender for Endpoint , while IdentityLogonEvents contains sign-in activity observed by Microsoft Defender for Identity sensors on domain controllers . Using unio n appends the rows from both sources into a single result set while preserving columns such as Timestamp , AccountDomain , AccountName , AccountUpn , and AccountSid . This is preferable to a join because the goal is to list sign-in attempts (not correlate rows between tables). Applying take 100 to each table segment ensures you're pulling the 100 most recent entries from each source before unioning, then you can reorder and sort by Timestamp to review the consolidated timeline.
Therefore, to meet the requirement - identify the 100 most recent sign-in attempts recorded on devices and AD DS domain controllers -complete the KQL with union and IdentityLogonEvents .