I think this might need to be @jerry
note this PR which needs integrating for the KQL to work - https://github.com/magicsword-io/LOLRMM/pull/100
original technical reporting - https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion
Related Troubleshooting Deception - https://gist.github.com/f-bader/5d949fad90d700feac6ed2bf43d8092f