We are looking for additional insights such as list of all the active user sessions and name of session host that they are connected to. We are sure that this information is populated already in the log analytics workspace its just that we need some assistance in deriving the correct log query.
What we currently get with the help of query below is the list of all user sessions and their session host names for last 12 hours, but it does not show information such as whether which user session is active or if it is connected from x amount of time or inactive from y amount of time etc.
| where State == "Connected" and TimeGenerated > ago(12h)
| order by TimeGenerated desc
| project UserName, SessionHostName, TimeGenerated
Any guidance on this will be helpful, Thanks in advance.