Critical Finding Overdue on Internet-Facing App

Requête originale, sans modification.

let maxAgeDays = 7;
let InternetFacingList = _GetWatchlist("InternetFacingApps")
    | project WL_ApplicationId = column_ifexists("ApplicationId", ""),
        WL_AppName = column_ifexists("AppName", ""),
        WL_Owner = column_ifexists("Owner", "");
StratoSecure_Findings_CL
    | where FixStatus =~ "open"
    | where Severity in ("Critical", "High")
    | extend AgeInDays = datetime_diff("day", now(), TimeGenerated)
    | where AgeInDays > maxAgeDays
    | join kind=inner InternetFacingList on $left.ApplicationId == $right.WL_ApplicationId
    | summarize TotalOverdueFindings = count(), OldestAge = max(AgeInDays),
        RuleIds = make_set(RuleId, 20), EndTime = max(TimeGenerated)
        by ApplicationId, WL_AppName, WL_Owner, StraTenantId
    | project TimeGenerated = EndTime, ApplicationId, AppName = WL_AppName, Owner = WL_Owner,
        StraTenantId, TotalOverdueFindings, OldestAge, RuleIds