Update Creating_Anomalous_Number_Of_Resources.yaml
Fixing line 17 - OperationNameValue match include syntax is wrong.
This commit is contained in:
Родитель
bdf622b995
Коммит
c495855532
|
@ -14,7 +14,7 @@ relevantTechniques:
|
|||
query: |
|
||||
|
||||
AzureActivity
|
||||
| where OperationNameValue in~ dynamic(["microsoft.compute/virtualMachines/write", "microsoft.resources/deployments/write"]);
|
||||
| where OperationNameValue in~ ("microsoft.compute/virtualMachines/write", "microsoft.resources/deployments/write")
|
||||
| where ActivityStatusValue == "Succeeded"
|
||||
| make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
|
||||
| extend AccountCustomEntity = Caller
|
||||
|
|
Загрузка…
Ссылка в новой задаче