Cisco Cloud Security - Connection to Unpopular Website Detected

Requête originale, sans modification.

let top_million_list = Cisco_Umbrella
| where EventType == "proxylogs"
| extend Hostname = parse_url(UrlOriginal)["Host"]
| summarize count() by tostring(Hostname)
| top 1000000 by count_
| summarize make_list(Hostname);
Cisco_Umbrella
| where EventType == "proxylogs"
| extend Hostname = parse_url(UrlOriginal)["Host"]
| where Hostname !in (top_million_list)
| extend Message = "Connect to unpopular website (possible malicious payload delivery)"
| project TimeGenerated, Message, SrcIpAddr, DstIpAddr, UrlOriginal