SpyCloud plaintext credential exposure detected

Original query, unchanged.

// Human-readable constant for the severity threshold used below
let severityThreshold = 20;
SpyCloudBreachWatchlistV2_CL
| where Severity == severityThreshold
// Severity alone determines this detection. mv-expand emits no rows for an empty
// array, which would silently drop exposures carrying no IP data, so substitute a
// single empty placeholder before expanding.
| extend IPList = iff(isnull(IPAddresses) or array_length(IPAddresses) == 0, dynamic([""]), IPAddresses)
| mv-expand IPAddress = IPList to typeof(string)
| extend AccountName = Username, AccountEmail = Email,
    AccountUpn = iff(isnotempty(Email), Email, Username)
| project TimeGenerated, DocumentId, SourceId, SpyCloudPublishDate, AccountEmail,
    TargetDomain, PasswordPlaintext, AccountName, AccountUpn, IPAddress