Zscaler - Shared ZPA session

Requête originale, sans modification.

let open_sessions =
ZPAEvent
| where DvcAction == 'open'
| summarize timestampstart = min(TimeGenerated) by DstUserName, SrcIpAddr, NetworkSessionId
| sort by timestampstart asc;
let closed_sessions =
ZPAEvent
| where TimeGenerated > ago(1h)
| where DvcAction == 'close'
| summarize timestampend = max(TimeGenerated) by DstUserName, SrcIpAddr, NetworkSessionId
| sort by timestampend asc;
open_sessions
| join (closed_sessions) on DstUserName
| sort by DstUserName, timestampstart
| extend prev_session_closetime = prev(timestampend,1)
| extend prev_session_starttime = prev(timestampstart,1)
| extend PreviousSrcIpAddr = prev(SrcIpAddr, 1)
| extend prev_sessionuser = prev(DstUserName, 1) 
| where DstUserName == prev_sessionuser
| where SrcIpAddr != PreviousSrcIpAddr
| where prev_session_closetime > timestampstart
| project DstUserName, SrcIpAddr, PreviousSrcIpAddr
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName