Azure-Sentinel
Azure-Sentinel copied to clipboard
ASimAuditEvent - Missing fields in vimAuditEventMicrosoftSecurityEvents
Describe the bug When running vimAuditEventMicrosoftSecurityEvents, Events related to Scheduled Task information results are missing the Value, NewValue, Object and ObjectType fields. These fields are present when running ASimAuditEventMicrosoftSecurityEvents
When
To Reproduce Steps to reproduce the behavior:
- Connect to a Sentinel Environment which has ingested 4698 - A scheduled task was created Events
- Execute the following tsql:
vimAuditEventMicrosoftSecurityEvents
| where EventOriginalType == 4698
- Observer that the Object,ObjectType,NewValue and Value fields are not returned
Expected behavior The fields should be returned, as they do when running the non-paramaterized version of the query
Additional context I have created and fix and will submit a PR shortly