I am trying to query in Defender Advanced hunting
Basically where I am having an issue is parsing the json for LoggedOnUsers and joining certain data there which is the Sid with IdentityInfo's CloudSid
For this one I am getting the error
Semantic error Error message Ensure that expression: LoggedOnUsers.Sid is indeed a simple name How to resolve Fix semantic errors in your query
DeviceTvmSoftwareInventory
| where SoftwareName contains "softwarename"
| distinct DeviceId, SoftwareName
| join kind=inner (
DeviceInfo
| mv-expand parsejson(LoggedOnUsers)
| extend LoggedOnUsers_Sid = tostring(toscalar(LoggedOnUsers.Sid))
| project DeviceId, LoggedOnUsers_Sid
)
on DeviceId
| join kind=inner (
IdentityInfo
)
on $left.LoggedOnUsers_Sid == $right.CloudSid
| project DeviceId, SoftwareName, AccountUpn