---

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "pornhub"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl
| summarize count() by InitiatingProcessAccountName, DeviceName