Update User Session Impersonation(Okta)

Azure · Dec 29, 2023 · 7f8e4ca · 7f8e4ca
1 parent 4cfc7f9
commit 7f8e4ca
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta) b/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta)
@@ -30,10 +30,8 @@ query: |
            TargetUser_alternateId = tostring(parsed_json.alternateId), 
            TargetUser_displayName = tostring(parsed_json.displayName), 
            Target_detailEntry = tostring(parsed_json.detailEntry) 
-  // Summarize event details to gain insights into the security context, including actor and target user information
-  | summarize StartTime = min(TimeGenerated), 
-              EndTime = max(TimeGenerated) 
-              by actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, 
+  // Project event details to gain insights into the security context, including actor and target user information
+  | project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, 
                  TargetUser_displayName, TargetUser_type, TargetUser_id, 
                  eventType_s, outcome_result_s
 entityMappings: