SAP BTP - Malware detected in BAS dev space

Original query, unchanged.

SAPBTPAuditLog_CL
| where Message has "malware"
| extend MessageData = parse_json(tostring(Message.data))
| extend MalwareData = parse_json(tostring(MessageData.message))
| extend
    ClusterID = tostring(MessageData.clusterID),
    WorkspaceID = tostring(MessageData.wsID),
    DevSpaceId = tostring(MalwareData.dev_space_id),
    User = tostring(MalwareData.user),
    Malware = strcat_array(MalwareData.findings, ", "),
    MessageText = tostring(MalwareData.message)
| extend
    AccountName = tostring(split(User, '@')[0]),
    UPNSuffix = tostring(split(User, '@')[1])
| where isnotempty(User) and isnotempty(Malware)
| project
    UpdatedOn,
    ClusterID,
    WorkspaceID,
    DevSpaceId,
    MessageText,
    User,
    Malware,
    Tenant,
    SpaceId,
    Category,
    CloudApp = "SAP BTP",
    AccountName,
    UPNSuffix