A threat analyst hunting in Microsoft Defender XDR Advanced Hunting wants to identify all devices that have made outbound connections to a newly published malicious domain and then correlate those devices with any interactive logons that occurred within 30 minutes after the connection. Which pair of tables should the analyst join to build this hunting query?