// Azure Monitor / Log Analytics. Read-only; not live-tested.
// Example review window around detection, not a confirmed attack window.
let StartTime = datetime(2026-09-24T00:00:00Z);
let EndTime = datetime(2026-09-27T00:00:00Z);
let TargetResourceId = "REPLACE_WITH_EXACT_RESOURCE_ID";
let TargetRequestName = "REPLACE_WITH_EXACT_REQUEST_NAME";
AppRequests
| where TimeGenerated >= StartTime and TimeGenerated < EndTime
| where _ResourceId =~ TargetResourceId
| where Name == TargetRequestName
| summarize StoredRows = count(), RepresentedRequests = sum(ItemCount)
    by bin(TimeGenerated, 15m), ResultCode, Success
| order by TimeGenerated asc
| take 500