KQL Cafe - February 2026

Recording

• Recording

Hosts

• Gianni
• Alex

Guests

• Ian Hanley

KQL News

Guest

Ian Hanley

Presentation Slides

Learn KQL

• Partition Operator

Most contacted remote IPs per device

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where isnotempty(RemoteIP)
| summarize Connections=count()
    by DeviceId, DeviceName, RemoteIP
| partition hint.strategy=native by DeviceId
(
    top 5 by Connections desc
)
| project DeviceName, RemoteIP, Connections