SpyCloud infostealer malware credential exposure

Original query, unchanged.

// Human-readable constant for the severity threshold used below
let severityThreshold = 25;
SpyCloudBreachWatchlistV2_CL
| where Severity == severityThreshold
| extend AccountName = Username, AccountEmail = Email, HostName = UserHostName,
    AccountUpn = iff(isnotempty(Email), Email, Username),
    // Under AlertPerResult every row becomes its own alert, so mv-expand on IPAddresses
    // would raise one alert per IP for the same machine and isolate it repeatedly.
    // Take the first address instead.
    IPAddress = tostring(IPAddresses[0])
// One alert per infected machine. InfectedMachineId is populated on every malware record,
// so it is a reliable dedupe key; without this a machine seen several times in the same
// window raises duplicate alerts and is acted on more than once. Deduplication is per rule
// execution, so a machine reappearing in a later window correctly raises a new alert.
| summarize arg_max(TimeGenerated, *) by InfectedMachineId
| project TimeGenerated, DocumentId, SourceId, SpyCloudPublishDate, AccountEmail,
    AccountName, AccountUpn, HostName, InfectedMachineId, InfectedTime, UserOS,
    IPAddress