Google Threat Intelligence - Threat Hunting Url

Requête originale, sans modification.

let ioc_lookBack = 1d;
_Im_WebSession
| where isnotempty(Url)
| extend lowerUrl=tolower(Url)
| join kind=inner (
ThreatIntelIndicators
| where ObservableKey == 'url:value'
| where isnotempty(ObservableValue)
| where SourceSystem == "Google Threat Intelligence"
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
| extend lowerUrl=tolower(ObservableValue)
) on lowerUrl
| project Url=ObservableValue, Description=Data.description, Type, TimeGenerated