“How can I find a specific element in a dynamic array in KQL?”
I am attempting to generate a table of privileged role activations over a period.
Amongst others I want to have columns for the attributes ‘TicketSystem’ and ‘TicketNumber’.
These appear in the field ‘AdditionalProperties’. This seems to be a dynamiccaly seized list or array.
But as this is a list or array of dynamic size (some fields are optional and not always present) I can not index a fixed position. I have to search inside the elements for the appropriate key names
instead.
I now have something along these lines:
AuditLogs | where TimeGenerated > now() - 7d | where Category == 'RoleManagement' | where TargetResources contains "Global Administrator" and ( OperationName contains "Add member to role completed (PIM activation)" or OperationName contains "Add eligible member to role in PIM completed" or OperationName contains "Add member to role outside of PIM" or OperationName contains "Add member to role request approved (PIM activation)" ) | extend _InitiatedByUPN = parse_json(InitiatedBy.user.userPrincipalName) | extend _Target_displayName = parse_json(TargetResources).[0].displayName | extend _Target_type = parse_json(TargetResources).[1].type | extend AD = parse_json(AdditionalDetails) | project format_datetime(ActivityDateTime,'yyyy-MM-dd HH:mm:ss'), Identity, _InitiatedByUPN, OperationName, _Target_displayName, ResultReason, AD.TicketSystem, AD.TicketNumber
But it gives empty entries for the columns AD.TicketSystem and AD.TicketNumber.
I have tried various modifications based on comparable questions and answers, but all fail.
VlijmenFileer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.