Azure CloudShell Usage

'This query look for users starting an Azure CloudShell session and summarizes the Azure Activity from that user account during that timeframe (by default 1 hour). This can be used to help identify abuse of the CloudShell to modify Azure resources.'