// Discovery query. Replace both synthetic placeholders with this run's accounts.
// Inspect actual emitted values; do not assume a particular AuthenticationType label.
let RunStart = ago(2h);
let Accounts = dynamic(["<exercise-account>", "<control-account>"]);
StorageFileLogs
| where TimeGenerated >= RunStart
| where AccountName in~ (Accounts)
| summarize Rows=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by AccountName, Protocol, AuthenticationType, OperationName, StatusText, SmbStatusCode
| order by AccountName asc, LastSeen desc