Ping Federate - Unexpected authentication URL.

let known_domains = 
PingFederateEvent
| where TimeGenerated between (ago(14d) .. (1d))
| where isnotempty(DeviceCustomString1)
| extend url_parsed = parse_url(DeviceCustomString1)
| extend url_domain = extract(@'.*\.(.*\.[a-z]+)', 1, tostring(url_parsed.Host))
| summarize makeset(url_domain);
PingFederateEvent
| where isnotempty(DeviceCustomString1)
| extend url_parsed = parse_url(DeviceCustomString1)
| extend url_domain = extract(@'.*\.(.*\.[a-z]+)', 1, tostring(url_parsed.Host))
| where url_domain !in (known_domains)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr