Add an example to the docs that highlights this search pattern:
| jmespath output=NewDisplayName "ExtendedProperties[?Name=='targetUpdatedProperties'].Value | from_string(@[0]) | [?ends_with(Name,'.DisplayName')].NewValue"
Thanks to @jpapasadora
MS O365 Management.
Search something like: sourcetype=ms:o365:management member (group OR role)
Add an example to the docs that highlights this search pattern:
Thanks to @jpapasadora
MS O365 Management.
Search something like:
sourcetype=ms:o365:management member (group OR role)