let DeviceToSearch = ""; //ENTER PC NUMBER HERE OR LEAVE BLANK TO LOOK FOR ALL RDP
let D2S = strcat(DeviceToSearch, ".wales.domain");
DeviceNetworkEvents
| where D2S !=".wales.domain" and DeviceName == D2S
    or D2S ==".wales.domain" and DeviceName matches regex @"^naming.convention.*"
| where LocalPort == "3389"
| where RemoteIP !in ("redacted.ip", "redacted.ip")
    and LocalIP !in ("redacted.ip", "redacted.ip")
| join kind=innerunique (DeviceNetworkEvents
| where RemotePort == "3389"
| project RDPer_IP = LocalIP, RDPed_IP =RemoteIP, RDPer_DeviceName= DeviceName
) on $left.RemoteIP==$right.RDPer_IP, $left.LocalIP==$right.RDPed_IP
| join kind=inner(
    DeviceLogonEvents
    | where LogonType =="RemoteInteractive"
    | where D2S !=".wales.domain" and DeviceName == D2S
        or D2S ==".wales.domain" and DeviceName matches regex @"^naming.convention.*"
        and RemoteIP!= "") on DeviceName
| where abs(datetime_diff("minute",Timestamp, Timestamp1)) < 5
| project Timestamp, DeviceName, RDPer_DeviceName, ActionType, RDPed_IP, RDPer_IP, AccountName, AccountDomain, InitiatingProcessFileName