Abnormal Security - High-risk email attack detected

Requête originale, sans modification.

ABNORMAL_SECURITY_THREAT_LOG_CL
| where abx_body_abx_body_attack_type_s in~ (
    "Phishing: Credential",
    "Social Engineering (BEC)",
    "Invoice/Payment Fraud (BEC)",
    "Malware",
    "Extortion",
    "Phishing: Sensitive Data",
    "Internal-to-Internal Attacks (Email Account Takeover)",
    "Scam")
| extend
    RecipientEmail = abx_body_abx_body_recipient_address_s,
    SenderEmail = abx_body_abx_body_from_address_s,
    SenderName = abx_body_abx_body_from_name_s,
    SenderIP = abx_body_abx_body_sender_ip_address_s,
    Subject = abx_body_abx_body_subject_s,
    MessageId = abx_body_abx_body_internet_message_id_s,
    AttackType = abx_body_abx_body_attack_type_s,
    AttackScore = abx_body_abx_body_attack_score_d,
    RemediationStatus = abx_body_abx_body_remediation_status_s,
    PortalUrl = abx_body_abx_body_abx_portal_url_s
| project TimeGenerated, RecipientEmail, SenderEmail, SenderName, SenderIP, Subject, MessageId, AttackType, AttackScore, RemediationStatus, PortalUrl