Azure Log Analytics KQL：如何从动态大小的 AuditLog AdditionalDetails 字段中投影特定键值

Question

“如何在 KQL 中找到动态数组中的特定元素？”

我正在尝试生成一段时间内特权角色激活的表。 除此之外，我希望拥有属性“TicketSystem”和“TicketNumber”的列。 这些出现在“附加属性”字段中。 这似乎是一个动态捕获的列表或数组。 但由于这是动态大小的列表或数组（某些字段是可选的并且并不总是存在），我无法索引固定位置。 我必须在元素内部搜索适当的键名称 相反。

我现在有一些类似的事情：

AuditLogs
| where TimeGenerated > now() - 7d
| where Category == 'RoleManagement'
| where
    TargetResources contains "Global Administrator"
    and
    (
        OperationName contains "Add member to role completed (PIM activation)"
            or OperationName contains "Add eligible member to role in PIM completed"
            or OperationName contains "Add member to role outside of PIM"
            or OperationName contains "Add member to role request approved (PIM activation)"
    )
| extend _InitiatedByUPN = parse_json(InitiatedBy.user.userPrincipalName)
| extend _Target_displayName = parse_json(TargetResources).[0].displayName
| extend _Target_type = parse_json(TargetResources).[1].type
| extend AD = parse_json(AdditionalDetails)
| project format_datetime(ActivityDateTime,'yyyy-MM-dd HH:mm:ss'), Identity, _InitiatedByUPN, OperationName, _Target_displayName, ResultReason, AD.TicketSystem, AD.TicketNumber

但它为 AD.TicketSystem 和 AD.TicketNumber 列提供了空条目。

我根据类似的问题和答案尝试了各种修改，但都失败了。

Answer 1

我根据您的查询创建了一个示例。所以回答你的问题：

使用

mv-expand AdditionalDetails

，如下所示：

let AuditLogs = datatable (
    TimeGenerated: datetime,
    Category: string,
    TargetResources: string,
    OperationName: string,
    InitiatedBy: dynamic,
    AdditionalDetails: dynamic,
    ActivityDateTime: datetime,
    Identity: string,
    ResultReason: string
)
[
    datetime(2024-06-28T10:00:00Z), "RoleManagement", '[{"displayName":"Global Administrator"},{"type":"Role"}]', "Add member to role completed (PIM activation)", dynamic({"user":{"userPrincipalName":"[email protected]"}}), dynamic([{"key":"TicketSystem", "value":"ServiceNow"}, {"key":"TicketNumber", "value":"INC001"}]), datetime(2024-06-28T10:00:00Z), "user1", "Success",
    datetime(2024-06-29T11:00:00Z), "RoleManagement", '[{"displayName":"Global Administrator"},{"type":"Role"}]', "Add eligible member to role in PIM completed", dynamic({"user":{"userPrincipalName":"[email protected]"}}), dynamic([{"key":"TicketSystem", "value":"Jira"}, {"key":"TicketNumber", "value":"TKT002"}]), datetime(2024-06-29T11:00:00Z), "user2", "Success",
    datetime(2024-06-30T12:00:00Z), "RoleManagement", '[{"displayName":"Global Administrator"},{"type":"Role"}]', "Add member to role outside of PIM", dynamic({"user":{"userPrincipalName":"[email protected]"}}), dynamic([{"key":"TicketSystem", "value":"ServiceNow"}, {"key":"TicketNumber", "value":"INC003"}, {"key":"TicketNumber", "value":"INC004"}, {"key":"TicketNumber", "value":"INC005"}]), datetime(2024-06-30T12:00:00Z), "user3", "Failure",
    datetime(2024-07-01T13:00:00Z), "RoleManagement", '[{"displayName":"Global Administrator"},{"type":"Role"}]', "Add member to role request approved (PIM activation)", dynamic({"user":{"userPrincipalName":"[email protected]"}}), dynamic([{"key":"TicketSystem", "value":"Jira"}, {"key":"TicketNumber", "value":"TKT004"}]), datetime(2024-07-01T13:00:00Z), "user4", "Success",
    datetime(2024-07-02T14:00:00Z), "RoleManagement", '[{"displayName":"Global Administrator"},{"type":"Role"}]', "Add member to role completed (PIM activation)", dynamic({"user":{"userPrincipalName":"[email protected]"}}), dynamic([{"key":"TicketSystem", "value":"ServiceNow"}, {"key":"TicketNumber", "value":"INC005"}]), datetime(2024-07-02T14:00:00Z), "user5", "Success",
    datetime(2024-07-03T15:00:00Z), "RoleManagement", '[{"displayName":"User"},{"type":"Role"}]', "Add member to role outside of PIM", dynamic({"user":{"userPrincipalName":"[email protected]"}}), dynamic([{"key":"TicketSystem", "value":"Jira"}, {"key":"TicketNumber", "value":"TKT006"}]), datetime(2024-07-03T15:00:00Z), "user6", "Failure"
];
AuditLogs
| where TimeGenerated >= ago(7d)
| where Category == 'RoleManagement'
| where
    TargetResources contains "Global Administrator"
    and
    (
        OperationName contains "Add member to role completed (PIM activation)"
            or OperationName contains "Add eligible member to role in PIM completed"
            or OperationName contains "Add member to role outside of PIM"
            or OperationName contains "Add member to role request approved (PIM activation)"
    )
| extend _InitiatedByUPN = InitiatedBy.user.userPrincipalName
| extend _Target_displayName = parse_json(TargetResources)[0].displayName
| extend _Target_type = parse_json(TargetResources)[1].type
| mv-expand AdditionalDetails
| extend TicketSystem = tostring(AdditionalDetails.key) 
| extend TicketNumber = tostring(AdditionalDetails.value) 
| project format_datetime(ActivityDateTime,'yyyy-MM-dd HH:mm:ss'), 
          Identity, 
          _InitiatedByUPN, 
          OperationName, 
          _Target_displayName, 
          ResultReason,
          TicketSystem,
          TicketNumber

在此处查找示例代码。

结果：