Forum Discussion

abon13's avatar
abon13
Brass Contributor
Oct 13, 2022

Optional function parameter

Hi,

 

How do I configure optional parameters in a function ? I do not see an OR option when configuring from Sentinel

KQL
siem

1 Reply

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Oct 13, 2022
    You can pass an empty or default value like my "0" in parameter 3 (p3). You can see in line 4 I have used an "or" to determine if Parameter 1 or Parmeter 2 is used I get a match. let SigninLogsfunction = (UserPrincipalName1:string, IdentityP2:string, P3:int) { SigninLogs | where TimeGenerated > ago(1d) | where UserPrincipalName ==UserPrincipalName1 or Identity==IdentityP2 | summarize count() by UserPrincipalName, Identity }; SigninLogsfunction ("email address removed for privacy reasons","Clive Watson",0)