Netskope - High Severity Alert

Original query, unchanged.

NetskopeAlertEvents_CL
| where TimeGenerated > ago(1h)
| where Alert =~ "yes"
| where Severity in~ ("high", "critical")
| extend NormalizedSeverity = tolower(Severity)
| summarize
    AlertCount = count(),
    Activities = make_set(Activity, 20),
    Applications = make_set(App, 20),
    Policies = make_set(Policy, 20),
    Actions = make_set(Action, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AlertName, AlertType, NormalizedSeverity, User, Userip, Hostname, SrcCountry
| order by AlertCount desc
| project
    LastSeen,
    AlertName,
    AlertType,
    Severity = NormalizedSeverity,
    User,
    Userip,
    Hostname,
    SrcCountry,
    AlertCount,
    Applications,
    Activities,
    Policies,
    Actions,
    FirstSeen