As you suspected, events is the way to do this.
execution.events during past 7d | summarize number_of_users = user.count() by context.device_platform