Forum Discussion
Get Custom Details from Sentinel
How do I go about getting the custom details set using https://learn.microsoft.com/en-us/azure/sentinel/surface-custom-details-in-alerts using REST API? I need to do this outside of logic app a...
Hello, so if you have defined Custom Details
You can then query for those (example basic query)
SecurityAlert
| where * contains "Custom Details"
| extend CustomDetails_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).["Custom Details"])).ParentFileName))[0])
| where isnotempty(CustomDetails_)
| project CustomDetails_
| take 1