Several deny actions registered

Original query, unchanged.

let threshold = 2;
union isfuzzy=true(
AZFWApplicationRule
| where Action == "Deny"
| summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
| where count_ >= threshold),
(AZFWNetworkRule
| where Action == "Deny"
| extend Fqdn = DestinationIp
| summarize StartTime = min(TimeGenerated), count_ = dcount(DestinationPort), Protocols = make_set(Protocol) by SourceIp, Fqdn, Action
| where count_ >= threshold
| extend Protocol = strcat_array(Protocols, "/")),
(AZFWFlowTrace
| where Action == "Deny"
| extend Fqdn = DestinationIp
| summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
| where count_ >= threshold),
(AZFWIdpsSignature
| where Action == "Deny"
| extend Fqdn = DestinationIp
| summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
| where count_ >= threshold),
(AzureDiagnostics
| where OperationName in ("AzureFirewallApplicationRuleLog","AzureFirewallNetworkRuleLog")
| extend msg_s_replaced0 = replace(@"\s\s",@" ",msg_s)
| extend msg_s_replaced1 = replace(@"\.\s",@" ",msg_s_replaced0)
| extend msg_a = split(msg_s_replaced1," ")
| extend srcAddr_a = split(msg_a[3],":") , destAddr_a = split(msg_a[5],":")
| extend Protocol = tostring(msg_a[0]), SourceIp = tostring(srcAddr_a[0]), srcPort = tostring(srcAddr_a[1]), DestinationIp = tostring(destAddr_a[0]), destPort = tostring(destAddr_a[1]), Action = tostring(msg_a[7])
| where Action == "Deny"
| extend Fqdn = iff(DestinationIp matches regex "\\d+\\.\\d+\\.\\d+\\.\\d+","",DestinationIp)
| summarize StartTime = min(TimeGenerated), count() by SourceIp, Fqdn, Action, Protocol
| where count_ >= threshold)