Defender for Endpoint Hunting Query E-Mail with Join

Hi There,

i try to create a Defender for Endpoint query to find out, who opens a Office Macro Dokument which was received via E-Mail wit external Domain before.

The First part of the Query to find out who opens Macro Documents is working see below.
My Problem is to Join the EmailAttachmentInfo Table into my Query. Do you have any Suggestion how to use Join for this suppose.
My QUery until now looks like this.

let unkommonfiletypes = dynamic([".docm",".xlsm",".dot",".wbk",".dotm",".docb",".xlsm",".xlm",".xltm",".xlam",".xla",".ppt",".pptm",".potm",".ppsm",".sldm"]);
let Officeprozesses = dynamic(["WINWORD","EXCEL", "PowerPoint", "Outlook"]);

DeviceProcessEvents
| where Timestamp > ago (1d)
| where FileName has_any (Officeprozesses)
| where ProcessCommandLine has_any (unkommonfiletypes)
| where ProcessCommandLine !has "Template.xlsm"
| where ProcessCommandLine !has "Template.docm"

// The join is not working. I Try to get only Alerts from Files, which are received by Mail before.**

| join (
EmailAttachmentInfo
| where SenderFromAddress !contains "@keyman .com"
| limit 10
) on Report ID*

Any Tips for me ?