Google Threat Intelligence - Threat Hunting Domain

Original query, unchanged.

let ioc_lookBack = 1d;
_Im_Dns
| where isnotempty(DnsQuery)
| extend lowerDomain=tolower(DnsQuery)
| join kind=inner (
ThreatIntelIndicators
| where ObservableKey == 'domain-name:value'
| where isnotempty(ObservableValue)
| where SourceSystem == "Google Threat Intelligence"
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
| extend lowerDomain=tolower(ObservableValue)
) on lowerDomain
| project Domain=ObservableValue, Description=Data.description, Type, TimeGenerated