From edfdcf9ed0bb8d66e2aaff0ff201339e8fa39701 Mon Sep 17 00:00:00 2001 From: Alekhya0824 Date: Tue, 10 Dec 2024 15:41:42 +0530 Subject: [PATCH] updated --- .../ASimAuthentication/Parsers/ASimAuthenticationNative.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml index ee2e68e54a..1da5c892a1 100644 --- a/Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml +++ b/Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml @@ -26,7 +26,7 @@ ParserQuery: | ASimAuthenticationEventLogs | where not(disabled) | extend User = TargetUsername, - Src = coalesce (SrcDvcId, SrcHostname, or SrcIpAddr), + Src = coalesce (SrcDvcId, SrcHostname, SrcIpAddr), IpAddr=SrcIpAddr, LogonTarget= coalesce (TargetAppName, TargetUrl, TargetHostname), Dst = coalesce (TargerDvcId, TargetHostname, TargetIpAddr, TargetAppId,TargetAppName),