Forum Discussion
Parse string in Azure Sentinel
Hello, we want to parse out the "subscription ID" as a field from the following string. Please let me know how can I do that? Column Name string privateLinkServiceId_ /subscriptions/"S...
AzureActivity
| extend entity_ = tostring(parse_json(Properties).entity)
| where isnotempty(entity_)
| parse entity_ with * '/subscriptions/' subscription_ '/' *
| project subscription_However SubscriptionId is already a column in that Table, so you can just do
AzureActivity
| extend entity_ = tostring(parse_json(Properties).entity)
| where isnotempty(entity_)
| project SubscriptionId