Uniqkey - Departing employee credential export

Requête originale, sans modification.

let lookback = 14d;
let frequency = 1h;
let exports =
    UniqkeyEvents_CL
    | where TimeGenerated > ago(lookback)
    | where Category == "data_export"
    | project ExportTime = TimeGenerated, ActorId, ActorEmail, ExportAction = Action, ExportedTargetType = TargetType, ExportedTargetName = TargetName, SrcIpAddr;
let removalActionIds = dynamic([
    "a2e18fcb-4d28-4f53-b2e3-24f03d0e188e", // Archive employee account
    "319c8a05-abd5-4b13-b51f-d6198578e61c", // Archive bulk employee
    "f1ed588f-975b-4bbe-83e9-e7a5c23e647f", // Hard delete employee
    "f8b81b6c-0082-4ed8-916e-83350f932e89", // Permanent delete employee account
    "4361dd86-0f70-47e0-91de-071a81d49834"  // Detach bulk employee account
]);
UniqkeyEvents_CL
| where TimeGenerated > ago(frequency)
| where Category == "account_management"
| where tolower(ActionId) in (removalActionIds) or Action has_any ("archive", "delete", "detach")
| where TargetType == "employee"
| project RemovalTime = TimeGenerated, RemovalAction = Action, RemovedEmployeeId = TargetId, RemovedEmployeeName = TargetName, RemovalActor = ActorEmail
| join kind=inner exports on $left.RemovedEmployeeId == $right.ActorId
| project RemovalTime, RemovalAction, RemovedEmployeeName, RemovalActor, ExportTime, ExportAction, ExportedTargetType, ExportedTargetName, ActorEmail, SrcIpAddr