Failed to resolve table or column expression named 'InformationProtectionEvents'

%3CLINGO-SUB%20id%3D%22lingo-sub-819679%22%20slang%3D%22en-US%22%3EFailed%20to%20resolve%20table%20or%20column%20expression%20named%20'InformationProtectionEvents'%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-819679%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3EI%26nbsp%3B%20try%20to%20run%20some%20AIP%20queries%20from%26nbsp%3B%3CSPAN%3ESentinel%20dashboard%20-%20Azure%20Information%20Protecton%20-%20Usage%20Report.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EInformationProtectionEvents%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3Eisnotempty(LabelId)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3Eisnotempty(ItemPath)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3EActivity%20in%20(%3C%2FSPAN%3E%3CSPAN%3E%22NewLabel%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%22UpgradeLabel%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%22DowngradeLabel%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%22RemoveProtection%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%22NewProtection%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%22ChangeProtection%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3Evalue%3D%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3CSPAN%3E()%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3ELabelName%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eorder%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3Evalue%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Erender%3C%2FSPAN%3E%3CSPAN%3Epiechart%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20i%20get%20error%20while%20retrieving%20data%3A%3C%2FP%3E%3CP%3E%3CSTRONG%3EFailed%20to%20resolve%20table%20or%20column%20expression%20named%20'InformationProtectionEvents'%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELogs%20are%20stored%20in%26nbsp%3BInformationProtectionLogs_CL%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHave%20you%20seen%20that%20error%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-819679%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-821342%22%20slang%3D%22en-US%22%3ERe%3A%20Failed%20to%20resolve%20table%20or%20column%20expression%20named%20'InformationProtectionEvents'%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-821342%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F129900%22%20target%3D%22_blank%22%3E%40Mariusz%20Sworst%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20%3CU%3E%26nbsp%3B%3C%2FU%3E%3CSTRONG%3EInformationProtectionEvents%20%3C%2FSTRONG%3Eis%20a%20function%20tat%20you%20should%20have%20setup%20by%20the%20connector%20(I%20think)%2C%20if%20you%20open%20Query%20Explorer%20and%20type%20%3CSTRONG%3EInformation%26nbsp%3B%20%3C%2FSTRONG%3Eyou%20should%20see%20it%20listed%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

Hi

I  try to run some AIP queries from Sentinel dashboard - Azure Information Protecton - Usage Report.

 

InformationProtectionEvents
| where isnotempty(LabelId)
| where isnotempty(ItemPath)
| where Activity in ("NewLabel", "UpgradeLabel", "DowngradeLabel", "RemoveProtection", "NewProtection", "ChangeProtection")
| summarize value=count() by LabelName
| order by value
| render piechart

 

But i get error while retrieving data:

Failed to resolve table or column expression named 'InformationProtectionEvents'

 

Logs are stored in InformationProtectionLogs_CL

 

Have you seen that error?

 

 

1 Reply

@Mariusz Sworst 

 

This  InformationProtectionEvents is a function tat you should have setup by the connector (I think), if you open Query Explorer and type Information  you should see it listed?