This metric was created mainly for reporting. It pulls any dark web monitoring breaches that have had a breach date within the last 30 days.
Users[].Breaches[?time_since(BreachDate, 'days') <=
30
] | [?length(@) >
0
]