Medium severity malicious activity detected

Requête originale, sans modification.

let TimeWindow   = 90d;    
let HitThreshold = 10;
let MinSeverity  = 2;
let EnableCategoryFilter    = true;
let EnableDescriptionFilter = false;
let EnableActionFilter      = false;
let CategoriesOfInterest = dynamic([
    "Possibly Unwanted Program Detected",
    "Possible Social Engineering Attempted",
    "Crypto Currency Mining Activity Detected",
    "A suspicious filename was detected",
    "A system call was detected"
]);
let DescriptionsOfInterest = dynamic([
    "pup-activity",
    "social-engineering",
    "coin-mining",
    "suspicious-filename-detect",
    "system-call-detect"
]);
let MatchActions = dynamic(["Deny", "alert"]);
AZFWIdpsSignature
| where TimeGenerated >= ago(TimeWindow)
| where Severity >= MinSeverity
| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
| where (EnableActionFilter == false) or (Action in~ (MatchActions))
| summarize
    StartTime   = min(TimeGenerated),
    EndTime     = max(TimeGenerated),
    TotalHits   = count(),
    MaxSeverity = max(Severity),
    Actions     = make_set(Action, 5),
    Signatures  = make_set(SignatureId, 20),
    Description = make_set(substring(tostring(Description), 0, 120), 3)
    by SourceIp, ThreatCategory = Category
| where TotalHits >= HitThreshold
| project
    StartTime,
    EndTime,
    SourceIp,
    ThreatCategory,
    TotalHits,
    MaxSeverity,
    Actions,
    Signatures,
    Description
| order by MaxSeverity desc, TotalHits desc