updates

jmillerca · Aug 24, 2023 · 8eaa1ce · 8eaa1ce
1 parent e8269a6
commit 8eaa1ce
Showing 1 changed file with 0 additions and 2 deletions.
diff --git a/Azure Active Directory/Identity-PotentialAiTM.kql b/Azure Active Directory/Identity-PotentialAiTM.kql
@@ -55,9 +55,7 @@ AADSignInEventsBeta
     and RiskLevels has_any ("50", "100") 
 | extend ['Count of SessionIds']=array_length(SessionIds)
 | extend ['Count of RiskTypes']=array_length(RiskTypes)
-| extend ReportId = "DefaultReportId" // Extend with a default ReportId or use an existing column
 | where ['Count of SessionIds'] >= 2 and ['Count of RiskTypes'] > 0
-| project Timestamp = LatestTimestamp, ReportId, CorrelationId, AccountUpn, ErrorCodes, RiskLevels, ['Count of SessionIds'], ['Count of RiskTypes']
 | distinct CorrelationId;
 AADSignInEventsBeta
 | where CorrelationId in (ids)