KQL for Defender & Sentinel