Identity Visualize World Map
Query
//Visualize your sign ins over a world map
//This visualization is supported in the Kusto Explorer app or the Web UI
//You can install the app here - https://learn.microsoft.com/en-us/azure/data-explorer/kusto/tools/kusto-explorer
//Data connector required for this query - Azure Active Directory - Signin Logs
SigninLogs
| where TimeGenerated > ago (90d)
| extend BeginLat = toreal(parse_json(tostring(LocationDetails.geoCoordinates)).latitude)
| extend BeginLon = toreal(parse_json(tostring(LocationDetails.geoCoordinates)).longitude)
| summarize Count=count() by BeginLon, BeginLat
| project-reorder BeginLon, BeginLat, Count
| where isnotempty(BeginLon)
| render scatterchart with (kind=map)Explanation
This query visualizes sign-ins on a world map. It uses Azure Active Directory - Signin Logs as the data source. The query filters the sign-in logs for the past 90 days and extracts latitude and longitude information from the location details. It then summarizes the count of sign-ins by latitude and longitude, and projects the results in the order of longitude, latitude, and count. Finally, it filters out any empty longitude values and renders the data as a scatter chart on a map.
Details
Matt Zorich
Released: August 14, 2023
Tables
SigninLogs
Keywords
SigninLogsTimeGeneratedBeginLatBeginLonLocationDetailsCountproject-reorderisnotemptyrender
Operators
whereagoextendtorealparse_jsontostringsummarizecountbyproject-reorderisnotemptyrender