Queries for the MicrosoftPurviewInformationProtection table
For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.
Microsoft Purview Information Protection events
Microsoft Purview Information Protection events summarized by label event type and workload.
MicrosoftPurviewInformationProtection
| summarize Value=count() by LabelEventType, Workload
| order by Value