Zero Networks Segment - Rare JIT Rule Creation

Requête originale, sans modification.

let starttime = 14d;
let endtime = 1d;
ZNSegmentAudit
| where TimeGenerated >= ago(endtime)
| where AuditTypeId == 20
| extend PerformedByName = tostring(InitiatedBy.Name),
    DestinationEntityName = tostring(AffectedEntity.Name)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ConnectionCount = count()
by PerformedByName, DestinationEntityName
  // use left anti to exclude anything from the previous 14 days that is not rare
| join kind=leftanti (
ZNSegmentAudit
| where TimeGenerated between (ago(starttime) .. ago(endtime))
| where AuditTypeId == 20
| extend DestinationEntityName = tostring(AffectedEntity.Name)
| summarize by DestinationEntityName
) on DestinationEntityName
| summarize StartTime = min(StartTime), EndTime = max(EndTime), ConnectionCount = sum(ConnectionCount)
by PerformedByName, DestinationEntityName
| extend TimeGenerated = StartTime