Analyse les événements de risque utilisateur liés aux identifiants compromis sur une période de 2 jours, en se concentrant sur les événements récents (dernières 5 minutes)

let query_frequency = 5m;
let query_period = 2d;
AADUserRiskEvents
| where TimeGenerated > ago(query_period)
| where OperationName == "User Risk Detection" and Source == "IdentityProtection" and RiskEventType == "leakedCredentials"
| summarize minTimeGenerated = min(TimeGenerated), arg_max(TimeGenerated, *) by Id
| where minTimeGenerated > ago(query_frequency)
| project
    TimeGenerated,
    OperationName,
    Source,
    Activity,
    UserDisplayName,
    UserPrincipalName,
    UserId,
    RiskEventType,
    RiskState,
    RiskDetail,
    RiskLevel,
    DetectionTimingType