TI map IP entity to Workday(ASimAuditEventLogs)

Requête originale, sans modification.

let dtLookBack = 1h; // Define the lookback period for audit events
let ioc_lookBack = 14d; // Define the lookback period for threat intelligence indicators
ThreatIntelligenceIndicator 
| where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period
| where isnotempty(NetworkIP)
      or isnotempty(EmailSourceIpAddress)
      or isnotempty(NetworkDestinationIP)
      or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId
  | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity
  | where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired
  | join kind=inner (
      ASimAuditEventLogs
      | where EventVendor == "Workday" // Filter for Workday events
      | where TimeGenerated >= ago(dtLookBack) // Filter events within the lookback period
      | where isnotempty(DvcIpAddr) // Filter for events with a device IP address
      | extend WD_TimeGenerated = EventStartTime // Rename the event start time column
      | project WD_TimeGenerated, ActorUsername, DvcIpAddr, Operation, Object // Select relevant columns
      )
      on $left.TI_ipEntity == $right.DvcIpAddr // Join on the IP entity
  | project
      LatestIndicatorTime,
      Description,
      ActivityGroupNames,
      IndicatorId,
      ThreatType,
      Url,
      ExpirationDateTime,
      ConfidenceScore,
      WD_TimeGenerated,
      ActorUsername,
      DvcIpAddr,
      Operation,
      Object // Select relevant columns after the join
  | extend
      timestamp = WD_TimeGenerated,
      Name = tostring(split(ActorUsername, '@', 0)),
      UPNSuffix = tostring(split(ActorUsername, '@', 1)) // Add additional fields for timestamp, name, and UPN suffix