How to combine two datamodels in the tstats command? I want to merge them to capture DCOM lateral movement events.

[quangnm21]

I want to combine these two events. Can anyone help me? I have tried using the join and append commands, but haven't been successful.

I want to analyze data in the 'Endpoint' model to capture information related to 'mmc' and then compare the 'ID' to retrieve IP and port information from the 'Network' model.

[quangnm21]

It did not work correctly