all_integrations.kql

GitHubAuditLogPolling_CL
| where action_s =~ "integration_installation.repositories_added" or action_s =~ "integration_installation.create"
| extend appName = tostring(name_s)
| extend organization = tostring(org_s)
| project-reorder TimeGenerated, actor_s, org_s, organization
| extend date_time = unixtime_milliseconds_todatetime(_timestamp_d)
| project TimeGenerated = date_time, AccountCustomEntity = actor_s, organization = org_s, appName , action = action_s

non_permitted_integrations.kql

let allowed_apps = dynamic(["Dependabot", "Microsoft Security DevOps"]);
GitHubAuditLogPolling_CL
| where action_s =~ "integration_installation.repositories_added" or action_s =~ "integration_installation.create"
| extend appName = tostring(name_s)
| where appName !in (allowed_apps)
| extend organization = tostring(org_s)
| project-reorder TimeGenerated, actor_s, org_s, organization
| extend date_time = unixtime_milliseconds_todatetime(_timestamp_d)
| project TimeGenerated = date_time, AccountCustomEntity = actor_s, organization = org_s, appName , action = action_s