Update OperationNameValue comparison operator
The OperationNameValue is sometimes mixed lower and uppercase. The lower case value drastically limits the number of results and overlooks the mixed case values of "Microsoft.Storage/storageAccounts/listKeys/action". Using the =~ operator accommodates the mixed case values.
This commit is contained in:
Родитель
b4963feacc
Коммит
f0540ea901
|
@ -20,11 +20,11 @@ relevantTechniques:
|
|||
query: |
|
||||
|
||||
AzureActivity
|
||||
| where OperationNameValue == "microsoft.storage/storageaccounts/listkeys/action"
|
||||
| where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action"
|
||||
| where ActivityStatusValue == "Succeeded"
|
||||
| join kind= inner (
|
||||
AzureActivity
|
||||
| where OperationNameValue == "microsoft.storage/storageaccounts/listkeys/action"
|
||||
| where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action"
|
||||
| where ActivityStatusValue == "Succeeded"
|
||||
| project ExpectedIpAddress=CallerIpAddress, Caller
|
||||
| evaluate autocluster()
|
||||
|
|
Загрузка…
Ссылка в новой задаче