```kusto SecurityIncident | mv-expand SystemAlertId=AlertIds | extend SystemAlertId=tostring(SystemAlertId) | join kind=fullouter SecurityAlert on SystemAlertId | project-away *1 // | extend isnotempty = isnotempty(column_ifexists("Entities", "")) // | extend exists = case( column_ifexists("Entities", false) == false, false, true) | where isnotempty(column_ifexists("Entities", "")) | extend Entities=todynamic(Entities) | mv-expand Entities | evaluate bag_unpack(Entities, 'ent') ```