correcting query text to fix yaml parsing

This commit is contained in:
Ashwin Patil 2020-02-11 13:02:51 -08:00
Родитель fcdb4e59c5
Коммит 7a0bb5aa62
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -59,7 +59,7 @@ query: |
normalizedProcessPath
| summarize StartTimeUtc=min(TimeGenerated), EndTimeUtc=max(TimeGenerated) by NormalizedProcessPath, Process
) on NormalizedProcessPath, Process;
freqs
freqs
| where frequency <= toscalar( freqs | serialize | project frequency | summarize percentiles(frequency, 5))
| order by frequency asc
| mvexpand Computer = list_Computer, Account = list_Account, ProcessPath = list_ProcessPath