Update Behavior - InboundConnectionFromMaliciousIP.md

[Lodewyk-Git]

Default value for arrays in Sentinel is dynamics, in MDE threat hunting it's either converted to json or is json by default.

[Lodewyk-Git]

*dynamic

[Bert-JanP]

Hi,

This option trows an error;

dynamic_to_json(): argument #1 must be a dynamic

This is because AdditionalFields is a string and not a dynamic field. The query below could parse it to JSON.

DeviceNetworkEvents
| extend x = todynamic(AdditionalFields)
| extend y = dynamic_to_json(x)

[Lodewyk-Git]

Strange, for me it gives the following error in Sentinel when ran, which is why I added the conversion. @Bert-JanP error:

`extractjson(): argument #2 expected to be a string expression

Request id: `

[Lodewyk-Git]

So like yea you're right it's a string by default, but you change it to a dynamic type in the query.

[Bert-JanP]

I will check again, and will come back at this next week. Have a good weekend!

[Bert-JanP]

Did some further investigation and came to the same conclusion. In this case MDE differs from he Sentinel results.