Azure Queries
Get Data from subfield
SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof(string)) SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof(string))