Construct KQL statements for Azure Sentinel