HoneyLabs TI Map IP Entity to Network Session (ASIM)

Requête originale, sans modification.

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
let HoneyLabs_IPs = ThreatIntelIndicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | where IsActive == true and ValidUntil > now()
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where SourceSystem startswith 'HoneyLabs'
  | where ObservableKey == 'ipv4-addr:value'
  | extend TI_ipEntity = tostring(ObservableValue),
           HoneyLabsConfidence = Confidence,
           IndicatorDescription = tostring(Data.description),
           HoneyLabsReport = strcat('https://honeylabs.net/lookup/', tostring(ObservableValue));
HoneyLabs_IPs
| join kind=innerunique (
    _Im_NetworkSession(starttime=ago(dt_lookBack))
    | where isnotempty(SrcIpAddr)
    | extend NS_ipEntity = SrcIpAddr
    | extend NetworkSession_TimeGenerated = TimeGenerated
) on $left.TI_ipEntity == $right.NS_ipEntity
| where NetworkSession_TimeGenerated < ValidUntil
| summarize NetworkSession_TimeGenerated = arg_max(NetworkSession_TimeGenerated, *) by Id, NS_ipEntity
| project NetworkSession_TimeGenerated, IndicatorDescription, Id, ValidUntil, HoneyLabsConfidence,
  HoneyLabsReport, TI_ipEntity, NS_ipEntity, SrcIpAddr, DstIpAddr, DstPortNumber, Dvc, EventResult
| extend timestamp = NetworkSession_TimeGenerated