// Session IDs are scoped to their server/account. Keep account and actor in the grouping.
// A missing-SPN error may stop at the KDC and produce no storage row.
let RunStart = ago(2h);
let Accounts = dynamic(["<exercise-account>", "<control-account>"]);
StorageFileLogs
| where TimeGenerated >= RunStart
| where AccountName in~ (Accounts)
| where isnotempty(SmbSessionID)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Rows=count(),
    Operations=make_set(OperationName, 30), SmbStatuses=make_set(SmbStatusCode, 30),
    CorrelationIds=make_set(CorrelationId, 30), Files=make_set(ObjectKey, 30)
    by AccountName, Protocol, SmbPrimarySID, SmbSessionID, SmbTreeConnectID
| order by FirstSeen asc