Lumen TI IPAddress in SigninLogs

Requête originale, sans modification.

let dt_lookBack = 1d;  // Data lookback for SigninLogs
let ioc_lookBack = 14d; // TI lookback
let IP_Indicators = ThreatIntelIndicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | where IsActive == true and ValidUntil > now()
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where SourceSystem == 'Lumen'
  | where ObservableKey == 'ipv4-addr:value'
  | extend TI_ipEntity = ObservableValue
  | where ipv4_is_private(TI_ipEntity) == false and TI_ipEntity !startswith 'fe80' and TI_ipEntity !startswith '::' and TI_ipEntity !startswith '127.';
IP_Indicators
| join kind=innerunique (
    SigninLogs
    | where TimeGenerated >= ago(dt_lookBack)
    | extend SL_ipEntity = IPAddress
    | extend SigninLogs_TimeGenerated = TimeGenerated
  ) on $left.TI_ipEntity == $right.SL_ipEntity
| where SigninLogs_TimeGenerated < ValidUntil
| summarize arg_max(SigninLogs_TimeGenerated, *), StartTime = min(SigninLogs_TimeGenerated), EndTime = max(SigninLogs_TimeGenerated) by Id, SL_ipEntity
| project timestamp = EndTime, StartTime, EndTime, UserPrincipalName, IPAddress, ResultType, AppDisplayName, Id, Tags, ValidUntil, Confidence, TI_ipEntity, SL_ipEntity, Type