Kusto question

[andrew_bryant]

Importing event logs into workspace that have a property like the following:

<Param>1</Param><Param>2</Param><Param>3</Param><Param>4</Param><Param>5</Param>

We are interested in the second parameter.  Is there a query that can distill this down into one property?

[#2 · Accepted solution]

Hi @andrew_bryant 

Are you asking about parsing?  Example:

print txt = "<Param>1</Param><Param>2</Param><Param>3</Param><Param>4</Param><Param>5</Param>"
| parse txt with *"<Param>2</" p2 "><Param>3"*

Go to Log Analytics and Run Query

txt	p2
12345	Param

[#3]

@andrew_bryant The Sentinel blog had a post a while ago about working with JSON that may help.

https://techcommunity.microsoft.com/t5/Azure-Sentinel/Tip-Easily-use-JSON-fields-in-Sentinel/ba-p/76...

[#4]

@CliveWatson 

This was what I was looking for.  Here is the query I ended up using:

Event

| parse ParameterXml with * "<Param>" SChannel "</Param><Param>" Username "</Param><Param>" domain "</Param><Param>" Workstation "</Param><Param>" channeltype

The event log source was NTLM operational log from DCs auditing NTLM requests.