From 7f8e4caeb0824a17e43193d13aeacb1292644b26 Mon Sep 17 00:00:00 2001
From: praveenthepro <99244859+praveenthepro@users.noreply.github.com>
Date: Fri, 29 Dec 2023 13:37:00 +0530
Subject: [PATCH] Update User Session Impersonation(Okta)

---
 .../Analytic Rules/User Session Impersonation(Okta)         | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta) b/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta)
index df0e30274fb..479665ca7a7 100644
--- a/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta)	
+++ b/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta)	
@@ -30,10 +30,8 @@ query: |
            TargetUser_alternateId = tostring(parsed_json.alternateId), 
            TargetUser_displayName = tostring(parsed_json.displayName), 
            Target_detailEntry = tostring(parsed_json.detailEntry) 
-  // Summarize event details to gain insights into the security context, including actor and target user information
-  | summarize StartTime = min(TimeGenerated), 
-              EndTime = max(TimeGenerated) 
-              by actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, 
+  // Project event details to gain insights into the security context, including actor and target user information
+  | project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, 
                  TargetUser_displayName, TargetUser_type, TargetUser_id, 
                  eventType_s, outcome_result_s
 entityMappings: