liorbp

KuandaLogs
//| where DetectiveId == "kvc2ac0c1fdbe22ec157c8"
| partition hint.strategy=native by DetectiveId
(
    order by Timestamp asc 
    | scan with_match_id = SessionId declare(StartTime:datetime, EndTime:datetime, Message: string) with (
        step start output=none:
            Message has 'User entered the system' or Message has 'User session reset' => StartTime = Timestamp;
        step collectTokens output=all:
            Timestamp > start.StartTime and Message has 'Captured user encryption token' or Message has 'token for this operation is disposed';