F&O - Bank account change following network alias reassignment

Requête originale, sans modification.

let query_frequency = 15m;
FinanceOperationsActivity_CL
| where LogType == "Update" and TableName == "UserInfo"
| extend UserId = tostring(parse_json(tostring(FormattedData.["03::id"])).NewData)
| extend NetworkAlias = parse_json(tostring(FormattedData.networkAlias))
| extend
    CurrentAlias = tostring(NetworkAlias.NewData),
    PreviousAlias = tostring(NetworkAlias.OldData)
| where CurrentAlias != PreviousAlias
| extend
    AliasUpdated = LogCreatedDateTime,
    AliasChangedBy = Username
| join kind=inner(FinanceOperationsActivity_CL
    | where TimeGenerated >= ago (query_frequency)
    | where LogType == "Update" and TableName == "BankAccountTable"
    | extend AccountId = tostring(parse_json(tostring(FormattedData.AccountID)).NewData)
    | extend AccountNum = parse_json(tostring(FormattedData.AccountNum))
    | extend
        CurrentAccountNum = tostring(AccountNum.NewData),
        OldAccountNum = tostring(AccountNum.OldData)
    | where CurrentAccountNum != OldAccountNum
    | extend BankUpdated = LogCreatedDateTime)
    on $left.UserId == $right.Username
| where BankUpdated > AliasUpdated
| extend
    FinOpsAppId = 32780,
    AccountName = tostring(split(CurrentAlias, "@")[0]),
    UPNSuffix = tostring(split(CurrentAlias, "@")[1])
| project
    AliasUpdated,
    AliasChangedBy,
    Username,
    AccountId,
    CurrentAccountNum,
    OldAccountNum,
    CurrentAlias,
    PreviousAlias,
    FinOpsAppId,
    AccountName,
    UPNSuffix