Closed Lodewyk-Git closed 11 months ago
*dynamic
Hi,
This option trows an error;
dynamic_to_json(): argument #1 must be a dynamic
This is because AdditionalFields is a string and not a dynamic field. The query below could parse it to JSON.
DeviceNetworkEvents
| extend x = todynamic(AdditionalFields)
| extend y = dynamic_to_json(x)
Strange, for me it gives the following error in Sentinel when ran, which is why I added the conversion. @Bert-JanP error:
`extractjson(): argument #2 expected to be a string expression
Request id:
So like yea you're right it's a string by default, but you change it to a dynamic type in the query.
I will check again, and will come back at this next week. Have a good weekend!
Did some further investigation and came to the same conclusion. In this case MDE differs from he Sentinel results.
Default value for arrays in Sentinel is dynamics, in MDE threat hunting it's either converted to json or is json by default.