updated

Azure · Dec 10, 2024 · edfdcf9 · edfdcf9
1 parent 087ce12
commit edfdcf9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml
@@ -26,7 +26,7 @@ ParserQuery: |
     ASimAuthenticationEventLogs  | where not(disabled)
       | extend
           User =  TargetUsername,
-          Src = coalesce (SrcDvcId, SrcHostname, or SrcIpAddr),
+          Src = coalesce (SrcDvcId, SrcHostname, SrcIpAddr),
           IpAddr=SrcIpAddr,
           LogonTarget= coalesce (TargetAppName, TargetUrl, TargetHostname),
           Dst = coalesce (TargerDvcId, TargetHostname, TargetIpAddr, TargetAppId,TargetAppName),