審核使用者產生的內容

{
  "Id": "3f5dd8d4-4ee1-4748-8855-56a8a0277bf9"
  "ConcernCategory": "Profanity",
  "Reason": "There was swearing in the description."
}

['events.all']
| where Timestamp > ago (3d)
| where FullName_Name == "item_reported"
| project ItemId = tostring(EventData.Payload.ItemId), ConcernCategory = tostring(EventData.Payload.ConcernCategory)
| summarize TotalReportCount = count() by ItemId, ConcernCategory
| sort by TotalReportCount desc
| render columnchart kind=stacked

['events.all']
| where Timestamp > ago (3d)
| where FullName_Name == "item_reported"
| where EventData.Payload.ItemId == "3f5dd8d4-4ee1-4748-8855-56a8a0277bf9"
| project Timestamp, ItemId = tostring(EventData.Payload.ItemId), ConcernCategory = tostring(EventData.Payload.ConcernCategory), Reason = tostring(EventData.Payload.Reason), ReportingPlayer = Entity_Id
| sort by Timestamp

{
  "Status": "AwaitingModeration",
  "Reason": "User reports over threshold",
  "Id": "3f5dd8d4-4ee1-4748-8855-56a8a0277bf9"
}

let TimeRange = ago(3d);
['events.all']
| where Timestamp > TimeRange
| where FullName_Name == "item_moderation_state_changed"
| project Timestamp, ItemId = tostring(EventData.Payload.ItemId)
| summarize MaxTimestamp = max(Timestamp) by ItemId
| extend TimeAndId = strcat(MaxTimestamp, "|", ItemId)
| join kind = leftouter (
    ['events.all']
    | where Timestamp > TimeRange
    | where FullName_Name == "item_moderation_state_changed"
    | project Timestamp, ItemId = tostring(EventData.Payload.ItemId), TargetStatus = tostring(EventData.Payload.TargetStatus), Reason = tostring(EventData.Payload.Reason)
    | extend TimeAndId = strcat(Timestamp, "|", ItemId)) on TimeAndId
| project Timestamp, ItemId, TargetStatus, Reason
| where TargetStatus == "AwaitingModeration"

{
  "Id": "852a2d2b-7754-427e-9ad4-fce2b24a4cef"
}