Identify instances where a single source is observed using multiple user agents (ASIM Web Session)

Requête originale, sans modification.

let threshold = 5; // Please update threshold limit as per your environment
_Im_WebSession(starttime=ago(1h), eventresult="Success")
| where isnotempty(HttpUserAgent)
| summarize
    EventCount=count(),
    UserAgentList=make_set(HttpUserAgent, 100),
    URL_List = make_set(Url, 100),
    DestinationIPList = make_set(DstIpAddr, 100)
    by SrcIpAddr, SrcUsername, SrcHostname, bin(TimeGenerated, 5min)
| extend UserAgentCount = array_length(UserAgentList)
| where UserAgentCount > threshold
| extend Name = iif(SrcUsername contains "@", tostring(split(SrcUsername,'@',0)[0]),SrcUsername), UPNSuffix = iif(SrcUsername contains "@",tostring(split(SrcUsername,'@',1)[0]),""), Threshold=threshold