Speculus - Sign-in attempt from high-risk IP indicator

Requête originale, sans modification.

let indicators = Speculus_Indicators_CL
    | where TimeGenerated > ago(14d)
    | where isnotempty(IndicatorValue)
    | where RiskScore >= 75
    | summarize arg_max(Modified, *) by IndicatorValue
    | project
        IndicatorValue,
        RiskScore,
        SpeculusActivity = Activity,
        Attribution,
        Labels,
        IndicatorDescription = Description;
SigninLogs
| where TimeGenerated > ago(1h)
| where isnotempty(IPAddress)
| join kind=inner indicators on $left.IPAddress == $right.IndicatorValue
| project
    TimeGenerated,
    IPAddress,
    UserPrincipalName,
    UserDisplayName,
    AppDisplayName,
    ResultType,
    ResultDescription,
    RiskScore,
    SpeculusActivity,
    Attribution,
    Labels,
    IndicatorDescription