Failed to resolve table or column expression named 'InformationProtectionEvents'

[Mariusz Sworst]

Hi

I  try to run some AIP queries from Sentinel dashboard - Azure Information Protecton - Usage Report.

InformationProtectionEvents

| where isnotempty(LabelId)

| where isnotempty(ItemPath)

| where Activity in ("NewLabel", "UpgradeLabel", "DowngradeLabel", "RemoveProtection", "NewProtection", "ChangeProtection")

| summarize value=count() by LabelName

| order by value

| render piechart

But i get error while retrieving data:

Failed to resolve table or column expression named 'InformationProtectionEvents'

Logs are stored in InformationProtectionLogs_CL

Have you seen that error?

[#2]

@Mariusz Sworst 

This  InformationProtectionEvents is a function tat you should have setup by the connector (I think), if you open Query Explorer and type Information  you should see it listed?