BOLA Finding with API Traffic Anomaly

Original query, unchanged.

let lookback = 1h;
let enumThreshold = 100;
let BolaFindings = StratoSecure_Findings_CL
    | where TimeGenerated >= ago(lookback)
    | where FixStatus =~ "open"
    | where OwaspCategory in ("API1", "API3", "API5")
    | where Severity in ("Critical", "High")
    | summarize FindingCount = count(), RuleIds = make_set(RuleId)
        by ApplicationId, StraTenantId;
let TrafficAnomalies = ApiManagementGatewayLogs
    | where TimeGenerated >= ago(lookback)
    | where ResponseCode in (403, 401, 404)
    | summarize ErrorCount = count(), DistinctCallers = dcount(CallerIpAddress),
        Paths = make_set(Url, 30), LastSeen = max(TimeGenerated)
        by ApiId, OperationId
    | where ErrorCount >= enumThreshold;
BolaFindings
    | join kind=inner TrafficAnomalies on $left.ApplicationId == $right.ApiId
    | project TimeGenerated = LastSeen, ApplicationId, StraTenantId,
        FindingCount, RuleIds, ErrorCount, DistinctCallers, Paths