SpyCloud identity access record exposure

Requête originale, sans modification.

// Human-readable constant for the severity threshold used below
let severityThreshold = 30;
SpyCloudBreachWatchlistV2_CL
| where Severity == severityThreshold
| extend AccountName = Username, AccountEmail = Email, HostName = UserHostName,
    AccountUpn = iff(isnotempty(Email), Email, Username),
    // Under AlertPerResult every row becomes its own alert, so mv-expand on IPAddresses
    // would raise one alert per IP for the same identity. Take the first address instead.
    IPAddress = tostring(IPAddresses[0])
// One alert per exposed identity. Session revocation acts per user, so a user appearing
// several times in the same window would otherwise be revoked repeatedly. Deduplication is
// per rule execution, so a reappearance in a later window correctly raises a new alert.
| summarize arg_max(TimeGenerated, *) by AccountUpn
| project TimeGenerated, DocumentId, SourceId, SpyCloudPublishDate, AccountEmail,
    AccountName, AccountUpn, HostName, TargetDomain, TargetUrl, AccountType, PasswordType,
    InfectedMachineId, InfectedTime, UserOS, IPAddress