Forum Discussion
how to add custom field in "CommonSecurityLog" Table
Hi Guys, I am adding new column in CommonSecurity Table. But i am having issue in kql quey. Please help me. This is Palo alto related logs. As "cat" field is in both Threat and System. So it is g...
You may consider using KQL extend operator to create custom fields from existing data (like AdditionalExtensions). To avoid overlap between Threat and System logs, you must conditionally extract values based on the Activity field.