Speculus - Network traffic to or from high-risk IP indicator

Original query, unchanged.

let indicators = Speculus_Indicators_CL
    | where TimeGenerated > ago(14d)
    | where isnotempty(IndicatorValue)
    | where RiskScore >= 75
    | summarize arg_max(Modified, *) by IndicatorValue
    | project
        IndicatorValue,
        RiskScore,
        SpeculusActivity = Activity,
        Attribution,
        Labels,
        IndicatorDescription = Description;
CommonSecurityLog
| where TimeGenerated > ago(1h)
| where isnotempty(SourceIP) or isnotempty(DestinationIP)
| extend MatchIP = iff(isnotempty(DestinationIP), DestinationIP, SourceIP)
| join kind=inner indicators on $left.MatchIP == $right.IndicatorValue
| project
    TimeGenerated,
    MatchIP,
    SourceIP,
    DestinationIP,
    DeviceVendor,
    DeviceProduct,
    RiskScore,
    SpeculusActivity,
    Attribution,
    Labels,
    IndicatorDescription