updated:

-- Diagnostic 
--	 Microsoft.OneCore.NetworkingTriage
--      Microsoft.Windows.Networking.DHCP
--      Microsoft.Windows.Networking.DNS
--      Microsoft.Windows.Networking.NetworkSetupSvc

NetworkingTriage.sql

@@ -2,6 +2,7 @@
 --		Microsoft.OneCore.NetworkingTriage
 --      Microsoft.Windows.Networking.DHCP
 --      Microsoft.Windows.Networking.DNS
+--      Microsoft.Windows.Networking.NetworkSetupSvc
 --
 -- from C:\ProgramData\Microsoft\Diagnosis\EventTranscript\EventTranscript.db
 -- For more info visit https://github.com/rathbuna/EventTranscript.db-Research
@@ -16,7 +17,7 @@ json_extract(events_persisted.payload,'$.ext.loc.tz') as 'TimeZome',
 json_extract(events_persisted.payload,'$.ext.utc.seq') as 'seq',
 
 -- events
-replace(replace(replace(replace(full_event_name,'Microsoft.OneCore.NetworkingTriage.GetConnected.',''),'Microsoft.Windows.Networking.DHCP.',''),'Microsoft.Windows.Networking.DHCPv6.',''),'Microsoft.Windows.Networking.DNS.','') as 'Event',
+replace(replace(replace(replace(replace(replace(full_event_name,'Microsoft.OneCore.NetworkingTriage.GetConnected.',''),'Microsoft.Windows.Networking.DHCP.',''),'Microsoft.Windows.Networking.DHCPv6.',''),'Microsoft.Windows.Networking.DNS.',''),'Microsoft.Windows.Networking.SharedAccess.',''),'Microsoft.Windows.Networking.NetworkSetupSvc.','') as 'Event',
 json_extract(events_persisted.payload,'$.data.eventSource') as 'Event Source',
 coalesce(json_extract(events_persisted.payload,'$.data.reason'),json_extract(events_persisted.payload,'$.data.eventSource')) as 'Event Reason',
 json_extract(events_persisted.payload,'$.data.previousReason') as 'Rrevious Reason',
@@ -77,6 +78,7 @@ case json_extract(events_persisted.payload,'$.data.DhcpGlobalUseNetworkHint')
 		end as 'LeaseObtained', -- in seconds
 time(json_extract(events_persisted.payload,'$.data.LeaseTime'),'unixepoch') as 'LeaseTime', -- in seconds (converted to HH:MM:SS)
 json_extract(events_persisted.payload,'$.data.NextHop') as 'NextHop', -- usually the Router IP
+json_extract(events_persisted.payload,'$.data.AssignedAddress') as 'AssignedAddress',
 json_extract(events_persisted.payload,'$.data.Dest') as 'Dest',
 json_extract(events_persisted.payload,'$.data.DestMask') as 'DestMask',
 
@@ -90,6 +92,14 @@ json_extract(events_persisted.payload,'$.data.interfaceDescription') as 'Interfa
 json_extract(events_persisted.payload,'$.data.interfaceGuid') as 'interfaceGuid',
 json_extract(events_persisted.payload,'$.data.SessionTrackingGuid') as 'Session',
 
+-- InstallPnPDevice
+json_extract(events_persisted.payload,'$.data.driverDesc') as 'driverDesc',
+json_extract(events_persisted.payload,'$.data.pnpId') as 'pnpId',
+json_extract(events_persisted.payload,'$.data.providerName') as 'providerName',
+json_extract(events_persisted.payload,'$.data.mediaType') as 'mediaType',
+json_extract(events_persisted.payload,'$.data.physicalMediaType') as 'physicalMediaType',
+
+
 -- Local, MS or AAD account 
 trim(json_extract(events_persisted.payload,'$.ext.user.localId'),'m:') as 'UserId',
 sid as 'User SID',
@@ -99,13 +109,19 @@ logging_binary_name
 
 from events_persisted 
 where 
+-- include events:
   (events_persisted.full_event_name like 'Microsoft.OneCore.NetworkingTriage.%' 
-or events_persisted.full_event_name like 'Microsoft.Windows.Networking.DHCP%' 
-or events_persisted.full_event_name like 'Microsoft.Windows.Networking.DNS.DnsServerConfig%')
+or events_persisted.full_event_name like 'Microsoft.Windows.Networking.SharedAccess.%' -- DHCP assigned IP
+or events_persisted.full_event_name like 'Microsoft.Windows.Networking.DHCP%' -- change to "DHCP." to skip DHCPv6 
+or events_persisted.full_event_name like 'Microsoft.Windows.Networking.DNS.DnsServerConfig.%'
+or events_persisted.full_event_name like 'Microsoft.Windows.Networking.NetworkSetupSvc.InstallPnPDevice%'
+or events_persisted.full_event_name like 'Microsoft.Windows.Networking.NetworkSetupSvc.ForeignNetworkInterface%')
+
+-- excluse event list:
 and events_persisted.full_event_name not like '%DiscoveryAttempt%'
 and events_persisted.full_event_name not like '%MediaConnected%'
 and events_persisted.full_event_name not like '%DhcpSetEventInRenewState%'
 and events_persisted.full_event_name not like '%SolicitAttempt%'
 and events_persisted.full_event_name not like '%InterfaceCapabilityChangedEvent%'
-
+-- Sort by date descending (newest first)
 order by events_persisted.timestamp desc