LogonType in("Resource access", "Failed logon") | extend Error = AdditionalFields["Error"] | extend KerberosType = AdditionalFields['KerberosType'] | where KerberosType == "KerberosAs" | extend Spns = AdditionalFields["Spns"] | extend DestinationDC = AdditionalFields["TO.DEVICE"] | where...