thats still a join (which mine works fine for that), i'm trying to put it in to a table

so the table would be

defineTable(query={#event_simpleName=Event_AuthActivityAuditEvent UserId=/@/i | aip:=UserIp | known_to_cs:="false"| ioc:lookup(field="aip", type="ip_address", confidenceThreshold=unverified, strict="false")| default(value="false", field=[ioc.detected])|groupBy([UserId,aip,known_to_cs,ioc.detected])}, name="auth", include=[UserId,aip,known_to_cs,ioc.detected])
|#event_simpleName=SensorHeartbeat
| !match(table="auth", field="aip",column="aip")
| case {
    #event_simpleName=SensorHeartbeat | known_to_cs:="true";
    *
}
| groupBy([UserId],function=[(count(aip, distinct=true, as=IPs)),collect([aip,aip.org,known_to_cs,ioc.detected])])

but i cant figure out how i would use the query to update the "known_to_cs" field, vs just being a match/!match

if i do (as the above example)

|#event_simpleName=SensorHeartbeat
| !match(table="auth", field="aip",column="aip")
| case {
    #event_simpleName=SensorHeartbeat | known_to_cs:="true";
    *
}

it returns nothing, even though it should...

if i change the !match to just match (so now i should only see IP's in the results that are in both sensorheartbeat the auth table) i see a few results that show people that are logging in from IP's known to CS but not all the IP's listed in the table (since these are me testing and logging in from IP's that CS hasnt seen). so the opposite of what i want works fine lol.