> For the complete documentation index, see [llms.txt](https://sandyzeng.gitbook.io/kql/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sandyzeng.gitbook.io/kql/kql-quick-guide/my-favorites/case.md).

# case

```
let RequiredApps = toscalar (datatable (AppName: string) [
 "1Password",
 "Camtasia 2021",
 "Azure Monitor Agent"
]
| summarize  make_set(AppName));
AppInventory_CL
| where TimeGenerated > ago (7d)
| summarize arg_max(TimeGenerated, *) by ManagedDeviceID_g, AppName_s
| summarize  InstalledApps = make_set(AppName_s) by ManagedDeviceID_g, ComputerName_s
| extend  MissingApps= set_difference(RequiredApps, InstalledApps)
| extend CompliantStatus = case(ComputerName_s has 'MTR', "I don't care", MissingApps <> '[]', 'Not Compliant', 'Compliant')
| project ComputerName_s, MissingApps, CompliantStatus
```

<figure><img src="https://3533425259-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbx8yn20QqNJtsVaH9CY7%2Fuploads%2FOGqkX7bww0FFyPl0E5mr%2Fimage.png?alt=media&amp;token=d3dfa8cc-93ca-4c5a-8a42-b604de8634f1" alt=""><figcaption></figcaption></figure>