Custom tabular function to enrich user info for each device in the results

DeviceUsers.kusto

// Advanced Hunting custom function
// ------------------------------------
// DeviceUsers()
// This function enriches a table with the users who use each device including full name, email, job title, etc.
// Example usage:
// ...
// | invoke DeviceUsers()
// ------------------------------------
let DeviceUsers = (T:(DeviceName:string)) {
    T
    | join kind=inner (DeviceInfo
        | distinct DeviceName, LoggedOnUsers
        | project DeviceName, CurrentUsers = parse_json(LoggedOnUsers)
        | mv-apply CurrentUsers on (
            project DeviceName, User = CurrentUsers.UserName, SID = CurrentUsers.Sid
        )
        | project DeviceName, Username = tostring(User), OnPremSid = tostring(SID)
        | join IdentityInfo on OnPremSid
    ) on DeviceName
};
DeviceUsers(Table);

UseFunction.kusto

// Example query that uses our custom DeviceUsers() function
// -------------------------------------
DeviceNetworkConnections
| where RemoteUrl contains ".ru"
| summarize Count = count() by DeviceName
| invoke DeviceUsers()  // <--- here is our custom tabular function, passing in the current table as a parameter
| extend FullName = strcat(GivenName, " ", Surname)
| project-reorder DeviceName, FullName, JobTitle, Count
| sort by Count desc

Currently this is a work in progress, Advanced Hunting doesn't seem to allow you to create functions that are supposed to be used with | invoke

You can still add this directly to your query for now, you just can't save it as a custom function

After doing more investigation and testing, I found that the updated query would work if Microsoft supported passing tables in as an argument to custom functions. Currently there is no option for table in the list of parameter types. If Microsoft would add that parameter type to their drop down menu, you would be able to make custom tabular functions and | invoke them.