Vaikora - Behavioral anomaly detected

Requête originale, sans modification.

Vaikora_AgentSignals_CL
| where TimeGenerated >= ago(6h)
| where is_anomaly_b == true
| where severity_s !in ("high", "critical")
| extend
    ActionId     = action_id_s,
    AgentId      = agent_id_s,
    ActionType   = action_type_s,
    Severity     = severity_s,
    Status       = status_s,
    AnomalyScore = anomaly_score_d
| project TimeGenerated, ActionId, AgentId, ActionType, Severity, Status, AnomalyScore
| order by AnomalyScore desc, TimeGenerated desc