PRODAFT USTA - Compromised credential used in successful sign-in

Original query, unchanged.

let lookback = 14d;
let detection = 1h;
let compromised =
    PRODAFTUstaCompromisedCredentials
    | where Created > ago(lookback)
    | where IsCorporate == true
    | where isnotempty(Username)
    | extend MatchName = tolower(Username)
    | summarize arg_max(TimeGenerated, TicketId, CompanyName, InfectionDate, Source) by MatchName;
SigninLogs
| where TimeGenerated > ago(detection)
| where ResultType == 0
| where isnotempty(UserPrincipalName)
| extend MatchName = tolower(UserPrincipalName)
| join kind=inner compromised on MatchName
| project
    TimeGenerated,
    UserPrincipalName,
    IPAddress,
    Location,
    AppDisplayName,
    ClientAppUsed,
    TicketId,
    CompanyName,
    Source,
    InfectionDate