OracleDBAudit - User connected to database from new IP

Original query, unchanged.

let lbtime_d = 14d;
let lbtime_24h = 24h;
OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
| where isnotempty(SrcIpAddr)
| where isnotempty(DstUserName)
| summarize knownIPs = make_set(SrcIpAddr) by DstUserName
| join (OracleDatabaseAuditEvent
      | where isnotempty(SrcIpAddr)
      | where isnotempty(DstUserName)
      | where DbAction =~ 'connect'
      ) on DstUserName
| where knownIPs !contains SrcIpAddr
| project DstUserName, SrcIpAddr
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr