SAST Auth Finding Correlated with Brute Force

Original query, unchanged.

let lookback = 1h;
let bruteForceThreshold = 20;
let AuthFindings = StratoSecure_Findings_CL
    | where TimeGenerated >= ago(lookback)
    | where FixStatus =~ "open"
    | where Severity in ("Critical", "High")
    | where RuleId has_any ("auth", "jwt", "login", "session", "token", "password", "credential")
    | summarize FindingCount = count(), RuleIds = make_set(RuleId), Repos = make_set(Repository)
        by ApplicationId, StraTenantId;
let BruteForce = SigninLogs
    | where TimeGenerated >= ago(lookback)
    | where ResultType != "0"
    | summarize FailedAttempts = count(), DistinctUsers = dcount(UserPrincipalName),
        IPList = make_set(IPAddress, 20), FirstAttempt = min(TimeGenerated), LastAttempt = max(TimeGenerated)
        by AppId, AppDisplayName
    | where FailedAttempts >= bruteForceThreshold;
AuthFindings
    | join kind=inner BruteForce on $left.ApplicationId == $right.AppId
    | project TimeGenerated = LastAttempt, ApplicationId, AppDisplayName, StraTenantId,
        FindingCount, RuleIds, Repos, FailedAttempts, DistinctUsers, IPList