Merge pull request Azure#4529 from Azure/shainw-MultiDS_Fixes

Fixing rename of count operation
yadong3333 · Mar 30, 2022 · d99c47d · d99c47d
2 parents 65aff17 + 38c259f
commit d99c47d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Hunting Queries/MultipleDataSources/ApplicationGrantedEWSPermissions.yaml b/Hunting Queries/MultipleDataSources/ApplicationGrantedEWSPermissions.yaml
@@ -40,7 +40,7 @@ query: |
   | join kind=leftouter (SecurityAlert
   | where ProviderName == "IPC"
   | extend User = tolower(tostring(parse_json(ExtendedProperties).["User Account"]))
-  | summarize count() by bin(TimeGenerated, 1d), User) on TimeGenerated, User
+  | summarize count_AlertName = count() by bin(TimeGenerated, 1d), User) on TimeGenerated, User
   | extend NumberofAADAlerts = iif(isnotempty(count_AlertName), count_AlertName, 0)
   | sort by NumberofAADAlerts desc
   | extend AppName = tostring(set_AppName[1])