0
votes

I am trying to create a search query for when a Public IP is assigned to a NIC, and then create an alert off that. I can find the part which identifies the assignment, but I need to use "inverted commas" within my search, but I can't...

My query:

AzureActivity
| where OperationName == "Microsoft.Network/networkInterfaces/write" and ActivityStatus == "Started"
| where Properties contains "<>"

Within that "contains", I need to use the following JSON pulled from the properties JSON (which I found doing a search without Properties Contains):

\"provisioningState\":\"Succeeded"\

However, I know I can't use "inverted commas" within an already inverted comma area. Is there a way to allow me to put that inside, perhaps with some sort of cancelling or bracketing?

3

3 Answers

0
votes
0
votes

I have found my solution, thanks to the links submitted by @Oleg Ananiev.

AzureActivity
| sort by TimeGenerated desc nulls last
| where OperationName == "Microsoft.Network/networkInterfaces/write" and ActivityStatus == "Started"
| where Properties contains '\\"provisioningState\\":\\"Succeeded\\"' 
0
votes

A better way to read to the nested property in JSON format using parse_json. For example if you would like to read to provisioningState property's value, simple do the following query

| where parse_json(Properties).provisioningState  == 'Succeeded'

Please let me know if that helps!