diff --git a/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta) b/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta) index df0e30274fb..479665ca7a7 100644 --- a/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta) +++ b/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta) @@ -30,10 +30,8 @@ query: | TargetUser_alternateId = tostring(parsed_json.alternateId), TargetUser_displayName = tostring(parsed_json.displayName), Target_detailEntry = tostring(parsed_json.detailEntry) - // Summarize event details to gain insights into the security context, including actor and target user information - | summarize StartTime = min(TimeGenerated), - EndTime = max(TimeGenerated) - by actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, + // Project event details to gain insights into the security context, including actor and target user information + | project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, TargetUser_displayName, TargetUser_type, TargetUser_id, eventType_s, outcome_result_s entityMappings: