PCI App with Open Findings Before Audit Window

Requête originale, sans modification.

let auditWindowDays = 30;
let PCIApps = _GetWatchlist("PCIApplications")
    | project WL_ApplicationId = column_ifexists("ApplicationId", ""),
        WL_AppName = column_ifexists("AppName", ""),
        WL_AuditDate = column_ifexists("AuditDate", ""),
        WL_Owner = column_ifexists("Owner", "");
let AuditCalendar = _GetWatchlist("AuditCalendar")
    | where column_ifexists("Framework", "") =~ "PCI-DSS"
    | extend UpcomingAudit = todatetime(column_ifexists("AuditDate", ""))
    | where UpcomingAudit between (now() .. now() + auditWindowDays * 1d)
    | project WL_Cal_ApplicationId = column_ifexists("ApplicationId", ""),
        Framework = column_ifexists("Framework", ""), UpcomingAudit;
StratoSecure_Findings_CL
    | where FixStatus =~ "open"
    | where Severity in ("Critical", "High")
    | join kind=inner PCIApps on $left.ApplicationId == $right.WL_ApplicationId
    | join kind=inner AuditCalendar on $left.ApplicationId == $right.WL_Cal_ApplicationId
    | summarize TotalOpenFindings = count(), MaxSeverityInt = max(SeverityInt),
        RuleIds = make_set(RuleId, 20), EndTime = max(TimeGenerated)
        by ApplicationId, WL_AppName, WL_Owner, Framework, UpcomingAudit, StraTenantId
    | extend MaxSeverity = case(
        MaxSeverityInt >= 9, "Critical",
        MaxSeverityInt >= 7, "High",
        MaxSeverityInt >= 4, "Medium",
        "Low")
    | project TimeGenerated = EndTime, ApplicationId, AppName = WL_AppName, Owner = WL_Owner,
        StraTenantId, Framework, UpcomingAudit, TotalOpenFindings, MaxSeverity, RuleIds