Explanation:

In Microsoft Defender XDR hunting, EmailAttachmentInfo includes metadata for received attachments (name, subject, and the file's SHA256 ), while DeviceFileEvents records file operations on endpoints (open
/read/execute) and also carries the SHA256 hash. Microsoft's guidance for efficient joins in KQL recommends correlating artifacts using stable, high-cardinality identifiers (hashes) rather than paths or URLs, becau se paths can change and URLs may not be preserved on disk; hashes uniquely identify the same file across mail and endpoint telemetry. To minimize query resources , Kusto's join kind=innerunique is preferred when the left side (EmailAttachmentInfo) is expect ed to have unique keys (one attachment hash per message instance) and you want at most one match per left record. It reduces shuffle/duplication compared to inner , improving performance while returning only devices that actually opened the same file (by ma tching SHA256 ) within the last 12 hours.
So the optimal query structure is:
EmailAttachmentInfo
| where Timestamp > ago(12h)
| where Subject == " Document Attachment " and FileName == " File1.pdf "
| join kind=innerunique
(DeviceFileEvents | where Timestamp > ago(12h))
on SHA256
This precisely identifies devices that received the email with File1.pdf and opened that same file, using the most efficient join strategy and a reliable correlation key.