CTE - Risky Device (Multiple IOC URL Hits)

Original query, unchanged.

CybereinforceCTE_CL
| where EventType == "block.url"
| extend d = parse_json(Details)
| extend
    DeviceId = tostring(d.deviceId),
    HostName = iff(isnotempty(tostring(d.hostname)), tostring(d.hostname), strcat("cte-device-", substring(EntityId, 0, 8))),
    DeviceUser = tostring(d.deviceUser),
    DeviceOs = tostring(d.deviceOs),
    DeviceVersion = tostring(d.deviceVersion),
    RuleId = tostring(d.ruleId),
    RuleName = iff(isnotempty(tostring(d.ruleName)), tostring(d.ruleName), "Pattern Match"),
    Pattern = tostring(d.pattern),
    Url = tostring(d.url),
    Action = tostring(d.action),
    IsIoc = tobool(d.ioc),
    ClientIp = tostring(split(tostring(d.clientIp), ":")[0]),
    ClientPort = tostring(split(tostring(d.clientIp), ":")[1]),
    UserAgent = tostring(d.userAgent)
| where RuleName == "Cybereinforce Threat Intelligence" or IsIoc == true
| summarize IOC_Hits=count(), BlockedUrls=make_set(Url, 50), ClientIps=make_set(ClientIp, 20), LastSeen=max(TimeGenerated) by DeviceId, HostName, DeviceUser, DeviceOs, TenantId
| where IOC_Hits >= 2
| extend Url = tostring(BlockedUrls[0]), ClientIp = tostring(ClientIps[0])