Update OperationNameValue comparison operator
The OperationNameValue is sometimes mixed lower and uppercase. The lower case value drastically limits the number of results and overlooks the mixed case values of "Microsoft.Storage/storageAccounts/listKeys/action". Using the =~ operator accommodates the mixed case values.
This commit is contained in:
Родитель
b4963feacc
Коммит
f0540ea901
|
@ -20,11 +20,11 @@ relevantTechniques:
|
||||||
query: |
|
query: |
|
||||||
|
|
||||||
AzureActivity
|
AzureActivity
|
||||||
| where OperationNameValue == "microsoft.storage/storageaccounts/listkeys/action"
|
| where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action"
|
||||||
| where ActivityStatusValue == "Succeeded"
|
| where ActivityStatusValue == "Succeeded"
|
||||||
| join kind= inner (
|
| join kind= inner (
|
||||||
AzureActivity
|
AzureActivity
|
||||||
| where OperationNameValue == "microsoft.storage/storageaccounts/listkeys/action"
|
| where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action"
|
||||||
| where ActivityStatusValue == "Succeeded"
|
| where ActivityStatusValue == "Succeeded"
|
||||||
| project ExpectedIpAddress=CallerIpAddress, Caller
|
| project ExpectedIpAddress=CallerIpAddress, Caller
|
||||||
| evaluate autocluster()
|
| evaluate autocluster()
|
||||||
|
|
Загрузка…
Ссылка в новой задаче