Detect known risky user agents (ASIM Web Session)

Requête originale, sans modification.

let lookback = 5m;
let knownUserAgentsIndicators = materialize(externaldata(UserAgent: string, UserAgentCategory: string)
  [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/UnusualUserAgents.csv"] 
  with(format="csv", ignoreFirstRecord=True)
  | extend joiner = 1);
let CustomUserAgentIndicators = (_ASIM_GetWatchlistRaw("UnusualUserAgents") // Create new Watchlist and add your custom indicators(Optional)
  | extend
      UserAgent = tostring(WatchlistItem["UserAgent"]),
      UserAgentCategory = tostring(WatchlistItem["UserAgentCategory"])
  | project UserAgent, UserAgentCategory, joiner = 1
  | where isnotempty(UserAgent) and isnotempty(UserAgentCategory));
let CombinedUAList = union knownUserAgentsIndicators, CustomUserAgentIndicators;
let knownUserAgents=toscalar(CombinedUAList
  | where isnotempty(UserAgent)
  | summarize make_list(UserAgent, 1000));
_Im_WebSession (starttime=ago(lookback), httpuseragent_has_any=knownUserAgents)
| project SrcIpAddr, SrcUsername, SrcHostname, HttpUserAgent, Url, DstIpAddr, DstPortNumber, TimeGenerated
| extend joiner = 1
| join kind=inner CombinedUAList on joiner
| where HttpUserAgent has UserAgent
| summarize
  EventCount=count(),
  EventStartTime = min(TimeGenerated),
  EventEndTime=max(TimeGenerated)
  by SrcIpAddr, SrcUsername, SrcHostname, Url, HttpUserAgent, DstIpAddr, DstPortNumber, UserAgentCategory
| extend Name = iif(SrcUsername contains "@", tostring(split(SrcUsername,'@',0)[0]),SrcUsername), UPNSuffix = iif(SrcUsername contains "@",tostring(split(SrcUsername,'@',1)[0]),"")