// Use the exact observed UTC test interval and this run's protected root/unique file marker.
// Export raw rows only to the private run directory; review identifiers before publication.
let RunStart = ago(2h);
let Accounts = dynamic(["<exercise-account>", "<control-account>"]);
let RunPathMarker = "workshop-<run-id>";
StorageFileLogs
| where TimeGenerated >= RunStart
| where AccountName in~ (Accounts)
| where Uri contains RunPathMarker or ObjectKey contains RunPathMarker
| project TimeGenerated, AccountName, Protocol, AuthenticationType,
    OperationName, SmbCommandDetail, SmbStatusCode, StatusCode, StatusText,
    SmbPrimarySID, RequesterUserName, SmbSessionID, SmbTreeConnectID,
    SmbMessageID, SmbFileId, CorrelationId, Uri, ObjectKey
| order by TimeGenerated asc