Вдруг кому пригодится по следам новостей от MS:
select(
@WindowsHost, WindowsHost.OsName, WindowsHost.
@CreationTime, WindowsHost.
@AuditTime, WindowsHost.
@PentestTime) | group(WindowsHost.OsName) | filter(windowsHost.osname not in ['Windows 10', 'Windows 8', 'Windows 8.1', 'Windows 2016', 'Windows 2019', 'Windows 2012', 'Windows 2012 R2'])