When you need to combine multiple tables (AlertInfo, AlertEvidence, and DeviceLogonEvents) and return all rows from all tables, you use the union operator in KQL (Kusto Query Language).

join would only return matching records between tables based on a key, not all rows.

evaluate is used for external function evaluations.

search * searches across all tables but doesn’t create structured combined output.

Using union kind=inner appends results from all three tables while maintaining their structure, allowing you to analyze all alerts, evidence, and logon activity together.

✅ Answer: D. union kind = inner