Blog Post

Microsoft Sentinel Blog
2 MIN READ

Tip: Easily use JSON fields in Sentinel

Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Jul 22, 2019
One of the great features with Azure Sentinel is that you can ingest any type of data and take care of parsing it later on at query time. Specifically, events originating from cloud sources often inc...
Updated Jul 24, 2019
Version 3.0
Query
Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Apr 05, 2020

PrashTechTalk : use the mv-expand operator. It will creates a separate row in the result set for each array value, enabling processing the array using regular KQL table processing.