Whisper Security - ASN Reputation Degradation

Original query, unchanged.

// MITRE ATT&CK: T1583.002 - Acquire Infrastructure: DNS Server
// Tactic: Resource Development
// Detects ASN reputation degradation (score increase > 20 points in 24h)
// Note: Higher reputationScore = worse reputation
let degradationThreshold = 20;
let currentScores = WhisperASNReputation_CL
    | where TimeGenerated > ago(1h)
    | summarize (LatestTime, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount) = arg_max(TimeGenerated, reputationScore, reputationLevel, asnName, country, prefixCount, peerCount) by asn
    | project asn, CurrentScore, CurrentLevel, AsnName, Country, PrefixCount, PeerCount;
let previousScores = WhisperASNReputation_CL
    | where TimeGenerated between (ago(1d) .. ago(1h))
    | summarize (PreviousTime, PreviousScore) = arg_max(TimeGenerated, reputationScore) by asn
    | project asn, PreviousScore;
currentScores
    | join kind=inner (previousScores) on asn
    | extend ScoreDelta = CurrentScore - PreviousScore
    | where ScoreDelta > degradationThreshold
    | project TimeGenerated = now(), ASN = asn, AsnName, OldScore = PreviousScore, NewScore = CurrentScore, ScoreDelta, CurrentLevel, Country, PrefixCount, PeerCount