// Authoring aid: replace the account name with this run's owned backend.
// Raw rows stay private. Publish only reviewed allowlisted correlation facts.
let WindowStart = ago(2h);
let WindowEnd = now();
let BackendAccounts = dynamic(["replace-with-owned-state-account"]);
StorageBlobLogs
| where TimeGenerated between (WindowStart .. WindowEnd)
| where AccountName in (BackendAccounts)
| project TimeGenerated, AccountName, OperationName, StatusCode, StatusText,
          AuthenticationType, ClientRequestId, CorrelationId, DurationMs, TlsVersion
| order by TimeGenerated asc