Forum Discussion

ChrisBlackburn's avatar
ChrisBlackburn
Copper Contributor
Jul 08, 2019

Using KQL queries to dive into dynamic arrays Azure Log Analytics

I'm running this command to break out the dynamic arrays   IntuneAuditLogs | where TimeGenerated > ago(7d) | extend propertiesJson = todynamic(Properties) | extend propertiesTargets = todynamic(...
azure monitor
Log Analytics
CliveWatson's avatar
CliveWatson
Former Employee
Jul 08, 2019

ChrisBlackburn 

 

If you know the Index number and field, then you can modify a query like this one to suit?

SecurityAlert 
//| where DisplayName == "Detected suspicious DNS resolution" 
| extend entities = todynamic(Entities) 
| project AlertName ,
          TimeGenerated,
          Description = parse_json(entities[0].HostName) ,
          osFamily =parse_json(entities[1].OSFamily)
ChrisBlackburn's avatar
ChrisBlackburn
Copper Contributor
Jul 08, 2019

CliveWatson extending the commands to expand out index 0

 

IntuneAuditLogs
| where TimeGenerated > ago(7d)
| extend propertiesJson = todynamic(Properties)
| extend propertiesTargets = todynamic(propertiesJson.Targets)
| extend mydisc = todynamic(propertiesTargets[0].ModifiedProperties)

 

What I've seen is as I continue to dig deeper into the properties, the ModifiedProperties field varies based on the specific operation, which makes it painful to determine the values I can consistently pull

 

Resources