Uniqkey - Credential export from newly created account

Requête originale, sans modification.

let lookback = 14d;
let frequency = 1h;
let provisioningActionIds = dynamic([
    "eb7dea42-df3a-44c6-808d-94b7fc46dde9", // Create employee account
    "263c44a2-2075-46bd-949d-aa828517a3d1", // Link employee account
    "4ed5b3be-d1b1-4447-af32-9ae2f1c090c7", // Activate employee
    "e494db5c-b135-441c-8fa3-6e5ad94d05f8", // Activate employee account
    "a652e6df-5a3c-438b-afde-198cd62e8491", // Activated account
    "c7d4f9b2-5e3a-4f8c-9b6d-2e7a1c8d5f3b", // Activate SSO employee
    "3cc88450-39ef-472e-9e0c-06ad7c9af257", // Process new employee
    "c9ebd265-3c60-4228-b948-863c8134d29c", // Approve process new employee
    "1b6c2121-00cc-40fe-9ea4-01f6dd085c34"  // Approve process invite employee
]);
let newAccounts =
    UniqkeyEvents_CL
    | where TimeGenerated > ago(lookback)
    | where Category == "account_management"
    | where tolower(ActionId) in (provisioningActionIds) or Action has_any ("create", "invite", "activate", "link")
    | where TargetType == "employee"
    | project CreationTime = TimeGenerated, CreationAction = Action, NewEmployeeId = TargetId, NewEmployeeName = TargetName;
UniqkeyEvents_CL
| where TimeGenerated > ago(frequency)
| where Category == "data_export"
| join kind=inner newAccounts on $left.ActorId == $right.NewEmployeeId
| where TimeGenerated > CreationTime
| project TimeGenerated, ActorEmail, ActorType, Action, TargetType, TargetName, SrcIpAddr, CreationTime, CreationAction, NewEmployeeName