Lumen TI IPAddress in SecurityEvents

Requête originale, sans modification.

let dt_lookBack = 1d;  // Data lookback for SecurityEvent
let ioc_lookBack = 14d; // TI lookback
let IP_Indicators = ThreatIntelIndicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | where IsActive == true and ValidUntil > now()
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where SourceSystem == 'Lumen'
  | where ObservableKey == 'ipv4-addr:value'
  | extend TI_ipEntity = ObservableValue
  | where ipv4_is_private(TI_ipEntity) == false and TI_ipEntity !startswith 'fe80' and TI_ipEntity !startswith '::' and TI_ipEntity !startswith '127.';
IP_Indicators
| join kind=innerunique (
    SecurityEvent
    | where TimeGenerated >= ago(dt_lookBack)
    | extend SE_ipEntity = IpAddress
    | extend SecurityEvent_TimeGenerated = TimeGenerated
  ) on $left.TI_ipEntity == $right.SE_ipEntity
| where SecurityEvent_TimeGenerated < ValidUntil
| summarize arg_max(SecurityEvent_TimeGenerated, *), StartTime = min(SecurityEvent_TimeGenerated), EndTime = max(SecurityEvent_TimeGenerated) by Id, SE_ipEntity
| project timestamp = EndTime, StartTime, EndTime, Computer, IpAddress, EventID, Activity, Id, Tags, ValidUntil, Confidence, TI_ipEntity, SE_ipEntity, Type