PCI App with Open Findings Before Audit Window

let auditWindowDays = 30;
let PCIApps = _GetWatchlist("PCIApplications")
| project WL_ApplicationId = column_ifexists("ApplicationId", ""),
        WL_AppName = column_ifexists("AppName", ""),
        WL_AuditDate = column_ifexists("AuditDate", ""),
        WL_Owner = column_ifexists("Owner", "");
let AuditCalendar = _GetWatchlist("AuditCalendar")
| where column_ifexists("Framework", "") =~ "PCI-DSS"
| extend UpcomingAudit = todatetime(column_ifexists("AuditDate", ""))
| where UpcomingAudit between (now() .. now() + auditWindowDays * 1d)
| project WL_Cal_ApplicationId = column_ifexists("ApplicationId", ""),
        Framework = column_ifexists("Framework", ""), UpcomingAudit;
StratoSecure_Findings_CL
| where FixStatus =~ "open"
| where Severity in ("Critical", "High")
| join kind=inner PCIApps on $left.ApplicationId == $right.WL_ApplicationId
| join kind=inner AuditCalendar on $left.ApplicationId == $right.WL_Cal_ApplicationId
| summarize TotalOpenFindings = count(), MaxSeverityInt = max(SeverityInt),
        RuleIds = make_set(RuleId, 20), EndTime = max(TimeGenerated)
        by ApplicationId, WL_AppName, WL_Owner, Framework, UpcomingAudit, StraTenantId
| extend MaxSeverity = case(
        MaxSeverityInt >= 9, "Critical",
        MaxSeverityInt >= 7, "High",
        MaxSeverityInt >= 4, "Medium",
        "Low")
| project TimeGenerated = EndTime, ApplicationId, AppName = WL_AppName, Owner = WL_Owner,
        StraTenantId, Framework, UpcomingAudit, TotalOpenFindings, MaxSeverity, RuleIds