This query is designed to detect new Remote Desktop Protocol (RDP) connections to devices that haven't been established in the past 20 days. Here's a simplified breakdown of what the query does:

1. Data Collection: It first gathers data on successful network connection events (specifically RDP connections) from the last 20 days. It filters out connections initiated by a specific process (Microsoft.Tri.Sensor.exe) and focuses on connections using the RDP port (3389).

2. Identify New Connections: The query then looks at RDP connections from the last 2 days and checks if these connections were not present in the data from the last 1 day. This helps in identifying new RDP connections that have appeared in the last 2 days but were not seen in the previous day.

3. Output: The results include details such as the timestamp of the connection, the device name, the account domain and name that initiated the connection, the command line used, and the remote URL and IP address. The results are sorted by the timestamp to show the most recent connections first.

The query is written for two different platforms, Defender XDR and Sentinel, with slight differences in the field names (Timestamp vs. TimeGenerated), but the logic remains the same.