Updating to proper column name and removing validation exception
This commit is contained in:
Родитель
ca92600995
Коммит
3f4fbc604b
|
@ -9,11 +9,6 @@
|
|||
"templateName": "TI map IP entity to GitHub_CL",
|
||||
"validationFailReason": "The name 'OperationType' does not refer to any known column, table, variable or function."
|
||||
},
|
||||
{
|
||||
"id": "f2dd4a3a-ebac-4994-9499-1a859938c947",
|
||||
"templateName": "Time series anomaly for data size transferred to public internet",
|
||||
"validationFailReason": "The name 'DestinationIP' does not refer to any known column, table, variable or function."
|
||||
},
|
||||
{
|
||||
"id": "e70fa6e0-796a-4e85-9420-98b17b0bb749",
|
||||
"templateName": "Solorigate Defender Detections",
|
||||
|
|
|
@ -38,7 +38,7 @@ query: |
|
|||
(
|
||||
VMConnection
|
||||
| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))
|
||||
| where isnotempty(DestinationIP) and isnotempty(SourceIP)
|
||||
| where isnotempty(DestinationIp) and isnotempty(SourceIp)
|
||||
| extend DestinationIpType = iff(DestinationIp matches regex PrivateIPregex,"private" ,"public" )
|
||||
| where DestinationIpType == "public" | extend DeviceVendor = "VMConnection"
|
||||
| project TimeGenerated, BytesSent, DeviceVendor
|
||||
|
|
Загрузка…
Ссылка в новой задаче