
Explanation:
Box 1: union
Use union to add the DeviceLogonEvent and the IdentityLogonEvents.
Box 2: IdentityLogonEvents
Example:
// Notice we no longer have the extra columns from a join. This might be useful if you want to track
// logon activity with devices (the DeviceLogonEvents table) and Active Directory \ Azure Active Directory
// (the IdentityLogonEvents table) in one query.
DeviceLogonEvents
| extend Table = 'DeviceLogonEvents'
| take 100
| union (
IdentityLogonEvents
| extend Table = 'IdentityLogonEvents'
| take 100
)
| project-reorder Timestamp, Table, AccountDomain, AccountName, AccountUpn, AccountSid
| order by Timestamp asc
Reference:
https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Webcasts/TrackingTheAdversary/Episode%202%20-%20Joins.txt