Whisper Security - BGP Route Anomaly with Traffic Spike

Original query, unchanged.

// MITRE ATT&CK: T1557 - Adversary-in-the-Middle
// Tactic: Collection
// Detects BGP route origin changes correlated with traffic volume anomalies
let lookbackPeriod = 1d;
let bgpChanges = WhisperHistory_CL
    | where TimeGenerated > ago(lookbackPeriod)
    | where isnotempty(bgpOrigin)
    | serialize
    | extend PreviousOrigin = prev(bgpOrigin), PreviousIndicator = prev(indicator)
    | where indicator == PreviousIndicator
    | where bgpOrigin != PreviousOrigin
    | where isnotempty(PreviousOrigin)
    | project indicator, bgpPrefix, OldOrigin = PreviousOrigin, NewOrigin = bgpOrigin, ChangeTime = snapshotDate;
let CommonSecurityLogSafe = union isfuzzy=true CommonSecurityLog, (datatable(TimeGenerated:datetime, DestinationIP:string, SentBytes:long, ReceivedBytes:long)[]);
let trafficBaseline = CommonSecurityLogSafe
    | where TimeGenerated > ago(lookbackPeriod)
    | where isnotempty(DestinationIP)
    | summarize BaselineBytes = avg(SentBytes + ReceivedBytes), BaselineCount = count() by DestinationIP, bin(TimeGenerated, 1h)
    | summarize AvgBaselineBytes = avg(BaselineBytes), AvgBaselineCount = avg(BaselineCount) by DestinationIP;
let recentTraffic = CommonSecurityLogSafe
    | where TimeGenerated > ago(15m)
    | where isnotempty(DestinationIP)
    | summarize RecentBytes = sum(SentBytes + ReceivedBytes), RecentCount = count() by DestinationIP;
recentTraffic
    | join kind=inner (trafficBaseline) on DestinationIP
    | where RecentBytes > AvgBaselineBytes * 3 or RecentCount > AvgBaselineCount * 3
    | extend TrafficChange = iff(AvgBaselineBytes > 0, round((RecentBytes - AvgBaselineBytes) / AvgBaselineBytes * 100, 2), 0.0)
    | join kind=inner (bgpChanges) on $left.DestinationIP == $right.indicator
    | project TimeGenerated = ChangeTime, IPAddress = DestinationIP, Prefix = bgpPrefix, OriginASN = NewOrigin, OldOriginASN = OldOrigin, TrafficChange, RecentBytes, AvgBaselineBytes