Azure Queries
=Get Data from subfield
SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof(string))
=Get Data from subfield
SecurityIoTRawEvent | where RawEventName == "ConnectionCreate" | project RemoteAddress=extractjson("$.RemoteAddress", EventDetails, typeof(string))