KQL Search

This query is designed to detect the installation of a specific plugin called "Copilot" in a cloud application. Here's a simple breakdown of what it does:

1. Data Source: It looks at events from CloudAppEvents.
2. Filter: It filters the events to only include those where the action type is "AppInstalled".
3. Extract Information: It extracts the name of the installed app from the raw event data and stores it in a new column called AppName.
4. Summarize: It groups the data by AppName, AccountType, and AccountDisplayName to summarize the installations.
5. Sort: It sorts the summarized results alphabetically by the app name (AppName).

In essence, this query identifies and lists all instances where the "Copilot" plugin has been installed, along with details about the account type and display name, sorted by the app name.