Tailscale: Mass credential revocation in short window

Requête originale, sans modification.

Tailscale_Audit_CL
      | where Action in ("REVOKE", "DELETE")
      | where tostring(Target.type) in ("API_KEY", "OAUTH_CLIENT", "AUTH_KEY")
      | extend ActorLogin = tostring(Actor.loginName)
      | summarize
          RevokedCount = count(),
          TargetTypes = make_set(tostring(Target.type)),
          TargetIds = make_set(tostring(Target.id)),
          FirstEvent = min(TimeGenerated),
          LastEvent = max(TimeGenerated)
        by ActorLogin, bin(TimeGenerated, 1h)
      | where RevokedCount >= 5
      | project TimeGenerated = LastEvent, ActorLogin, RevokedCount, TargetTypes, TargetIds, FirstEvent, LastEvent