KQL Search

This KQL (Kusto Query Language) query is designed to search through device event logs for specific activities related to a particular type of named pipe. Here's a simple breakdown of what the query does:

1. Data Source: It starts by looking at the DeviceEvents table.
2. Filter by ActionType: It filters the events to only include those where the ActionType field contains the word "pipe".
3. Parse JSON: It then parses the AdditionalFields column as JSON and creates a new column called parsed.
4. Filter by PipeName: Finally, it filters the results further to include only those events where the PipeName field within the parsed JSON contains the string "psexesvc".

In summary, this query is looking for device events involving pipes, specifically those where the pipe name includes "psexesvc".