Optimizing KQL queries | Microsoft 365 Defender