
Explanation:
Box 1: innerunique
The innerunique join flavor removes duplicate keys from the left side. This behavior ensures that the output contains a row for every combination of unique left and right keys.
By default, the innerunique join flavor is used if the kind parameter isn't specified. This default implementation is useful in log/trace analysis scenarios, where you aim to correlate two events based on a shared correlation ID. It allows you to retrieve all instances of the phenomenon while disregarding duplicate trace records that contribute to the correlation.
Box 2: FileOriginUrl
The DeviceFileEvents table in the advanced hunting schema contains information about file creation, modification, and other file system events.
Reference:
https://learn.microsoft.com/en-us/kusto/query/join-innerunique
https://learn.microsoft.com/en-us/kusto/query/join-operator
https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicefileevents-table