MDA File Download By Country
Query
CloudAppEvents
| where ActionType startswith "FileDownloaded" //download or download from browser
| summarize count() by CountryCode//, tostring(IPTags)Explanation
This query is analyzing data from a table called CloudAppEvents. It is specifically looking for events where the action type begins with "FileDownloaded," which indicates that a file was downloaded, either directly or through a browser.
The query then groups these download events by the country code associated with each event and counts the number of download events for each country. The result is a summary that shows how many file download events occurred in each country.
Details
Jay Kerai
Released: October 2, 2025
Tables
CloudAppEvents
Keywords
CloudAppEventsActionTypeFileDownloadedCountryCode
Operators
startswithsummarizecountby