Hi!
I have a search query problem that's wrecking my newbie brain.
I have log events that look like this:
{
"operationName": "Add app role assignment to group",
"properties": {
...
See more...
Hi!
I have a search query problem that's wrecking my newbie brain.
I have log events that look like this:
{
"operationName": "Add app role assignment to group",
"properties": {
"targetResources": [
{
"administrativeUnits": [],
"displayName": "MyAwesomeDisplayName",
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"modifiedProperties": [
{
"displayName": "AppRole.Id",
"newValue": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"oldValue": null
},
{
"displayName": "AppRole.Value",
"newValue": null,
"oldValue": null
},
{
"displayName": "Group.ObjectID",
"newValue": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"oldValue": null
},
{
"displayName": "Group.DisplayName",
"newValue": "myAwesomeGroupName",
"oldValue": null
},
{
"displayName": "Group.WellKnownObjectName",
"newValue": null,
"oldValue": null
}
],
"type": "ServicePrincipal"
}
],
"userAgent": null
}
}
What I'm trying to do is get the corresponding value for newValue where displayName is Group.DisplayName. i.e. when displayName=Group.DisplayName, the corresponding newValue for that would be (in this example) myAwesomeGroupName.
Not every log event will have a displayName=Group.DisplayName event in it, so that's why I'm looking to capture when it's there.
I hope that makes sense.