User Profile
ashishrajsrivastava
MCT
Joined Sep 12, 2018
User Widgets
Recent Discussions
How to compare a array values in a column against another array from a watchlist in Kusto
I am getting results with a column named IPAddresses having values in array. I want to compare each value in this array to a list (another array from a watch list). I have been trying to make use of mv-apply but with no success, can any guide me in this. Here is my code snippet: let timeframe = ago(3h); let threshold = 2; let ZSwatchlist = (_GetWatchlist('zscaler') | project SearchKey); let zarray = (ZSwatchlist | summarize zlist = make_list(SearchKey)); let users = (imAuthentication | where TargetUserType != 'ServicePrincipal' | where TimeGenerated > timeframe | where EventType == 'Logon' and EventResult == 'Success' | where isnotempty(SrcGeoCountry) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Vendors=make_set(EventVendor), Products=make_set(EventProduct), Countries = make_set(SrcGeoCountry), IPAddresses = make_set(SrcDvcIpAddr) , NumOfCountries = dcount(SrcGeoCountry) by TargetUserId, TargetUsername, TargetUserType); users | mv-apply ipscaler=toscalar(IPAddresses) to typeof(string) on( where not(ipv4_is_in_range(IPAddresses,zarray)) )5.2KViews0likes4CommentsRe: Azure Sentinel Automation (Preview) - Issue with Permission assignment
In my scenario i am using analytical rule and runbook both in primary tenant. I have contributor level permissions on resource group containing sentinel and logic apps, rg containing runbook is already allowed permission to run runbook from Sentinel Setting runbook permissions. When I try to run the runbook from incident alerts I am getting Missing Permissions to view playbook runs. We are using Lighthouse but here we are not doing anything cross tenant in terms of Sentinel. I have Sentinel Contributor role on the Lighthouse level as well.11KViews0likes0Comments
Groups
Developer User Group Leaders Hub
The place where user group leaders who want to be in the know -- on the latest & greatest from Microsoft Dev Tools, Azure, and AI topics -- come together to discuss, learn, share best practices, and get weekly updates.Recent Blog Articles
No content to show