Malware attachment delivered

Requête originale, sans modification.

ProofPointTAPMessagesDeliveredV2_CL
| mv-expand todynamic(threatsInfoMap)
| mv-expand todynamic(messageParts)
| extend threatType = tostring(threatsInfoMap.threatType), classification = tostring(threatsInfoMap.classification)
| extend filename = tostring(messageParts.filename)
| where threatType =~ "attachment" and classification =~ "malware"
| summarize filenames = make_set(filename), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by TimeGenerated, Sender = sender, SenderIPAddress = senderIP, Recipient = tostring(recipient), threatType, classification, Subject = subject
| mv-expand todynamic(Recipient)
| extend RecipientName = tostring(split(Recipient, "@")[0]), RecipientUPNSuffix = tostring(split(Recipient, "@")[1])
| extend SenderName = tostring(split(Sender, "@")[0]), SenderUPNSuffix = tostring(split(Sender, "@")[1])