CloudNGFW By Palo Alto Networks - Threat signatures from Unusual IP addresses

Original query, unchanged.

let starttime = 7d;
let endtime = 1d;
let timeframe = 1h;
let HistThreshold = 25; 
let CurrThreshold = 10; 
let HistoricalThreats = fluentbit_CL
| where ident_s == "THREAT"
| extend message = parse_json(Message)
| where isnotempty(message.src_ip)
| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
| where message.sub_type in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')
| extend src_ip = tostring(message.src_ip)
| summarize TotalEvents = count(), ThreatTypes = make_set(message.sub_type), DestinationIpList = make_set(message.dst), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by src_ip, tostring(message.action), FirewallName_s;
let CurrentHourThreats = fluentbit_CL
| where ident_s == "THREAT"
| extend message = parse_json(Message)
| where isnotempty(message.src_ip)
| where TimeGenerated > ago(timeframe)
| where message.sub_type in ('spyware', 'scan', 'file', 'vulnerability', 'flood', 'packet', 'virus','wildfire', 'wildfire-virus')
| extend src_ip = tostring(message.src_ip)
| summarize TotalEvents = count(), ThreatTypes = make_set(message.sub_type), DestinationIpList = make_set(message.dst), FirstSeen = min(TimeGenerated) , LastSeen = max(TimeGenerated) by src_ip, tostring(message.action), FirewallName_s;
CurrentHourThreats 
| where TotalEvents < CurrThreshold
| join kind = leftanti (HistoricalThreats 
| where TotalEvents > HistThreshold) on src_ip