from typing import Dict
from datetime import datetime


def create_time_period_kqlfilter(periods: Dict[datetime, datetime]) -> str:
    """
    Create KQL time filter expression from time periods dict.

    Parameters
    ----------
    periods : Dict[datetime, datetime]
        Dict of start, end periods

    Returns
    -------
    str
        KQL filter clause

    """
    time_column = "TimeGenerated"
    time_brackets = [
        f"{time_column} between (datetime({start}) .. datetime({end}))"
        for start, end in periods.items()
    ]

    return f"| where {' or '.join(time_brackets)}"