// Illustrative; not executed against a live workspace. CUSTOM application table, not a built-in schema.
// Requires one event per object emitted; the contract is defined in the playbook.
// Include only request IDs independently confirmed unauthorized; do not classify by account alone.
let Start = ago(24h);
let End = now();
let TargetApi = "REPLACE_WITH_API_ID";
let CaseRequestIds = dynamic(["REPLACE_WITH_CONFIRMED_UNAUTHORIZED_REQUEST_ID"]);
ApiObjectAccess_CL
| where TimeGenerated between (Start .. End)
| where ApiId == TargetApi and CorrelationId in (CaseRequestIds)
| where ObjectEmitted == true and ResponseCode between (200 .. 299)
| where isnotempty(ObjectTenantId) and isnotempty(ObjectId)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by ObjectTenantId, ObjectId
| summarize ExactObservedObjects = count(),
            FirstSeen = min(FirstSeen), LastSeen = max(LastSeen)