Lumen TI IPAddress in WindowsEvents

Requête originale, sans modification.

let dt_lookBack = 1d;  // Data lookback for WindowsEvents
let ioc_lookBack = 14d; // TI lookback
let IP_Indicators = ThreatIntelIndicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | where IsActive == true and ValidUntil > now()
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where SourceSystem == 'Lumen'
  | where ObservableKey == 'ipv4-addr:value'
  | extend TI_ipEntity = ObservableValue
  | where ipv4_is_private(TI_ipEntity) == false and TI_ipEntity !startswith 'fe80' and TI_ipEntity !startswith '::' and TI_ipEntity !startswith '127.';
IP_Indicators
| join kind=innerunique (
    WindowsEvent
    | where TimeGenerated >= ago(dt_lookBack)
    | extend WE_ipEntity = tostring(EventData.IpAddress)
    | extend WindowsEvent_TimeGenerated = TimeGenerated
  ) on $left.TI_ipEntity == $right.WE_ipEntity
| where WindowsEvent_TimeGenerated < ValidUntil
| summarize arg_max(WindowsEvent_TimeGenerated, *), StartTime = min(WindowsEvent_TimeGenerated), EndTime = max(WindowsEvent_TimeGenerated) by Id, WE_ipEntity
| project timestamp = EndTime, StartTime, EndTime, Computer, EventID, Channel, Id, Tags, ValidUntil, Confidence, TI_ipEntity, WE_ipEntity, Type