A SOC analyst in Microsoft Defender XDR Advanced Hunting suspects that several endpoints are beaconing to a command-and-control server at regular intervals. The analyst wants to identify devices making repeated outbound connections to the same remote IP address over the past 7 days, and calculate the time interval consistency between those connections to spot beaconing behavior. Which table should form the base of the KQL query?