Skip to content

Commit c222639

Browse files
Update run-advanced-query-api.md
With the query format given as it was, one gets an error like the one below: { "error": { "code": "InvalidRequestBody", "message": "Missing query.", "target": "|cd9f5106-4aa2341c0de87fd0.1.2." } } Correct request body is a one liner: { "Query": "DeviceProcessEvents | where InitiatingProcessFileName =~ 'powershell.exe'| where ProcessCommandLine contains 'appdata'| project Timestamp, FileName, InitiatingProcessFileName, DeviceId |limit 2" }
1 parent 4919a5a commit c222639

File tree

1 file changed

+1
-5
lines changed

1 file changed

+1
-5
lines changed

defender-endpoint/api/run-advanced-query-api.md

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,7 @@ POST https://api.securitycenter.microsoft.com/api/advancedqueries/run
106106

107107
```json
108108
{
109-
"Query":"DeviceProcessEvents
110-
|where InitiatingProcessFileName =~ 'powershell.exe'
111-
|where ProcessCommandLine contains 'appdata'
112-
|project Timestamp, FileName, InitiatingProcessFileName, DeviceId
113-
|limit 2"
109+
"Query":"DeviceProcessEvents |where InitiatingProcessFileName =~ 'powershell.exe' |where ProcessCommandLine contains 'appdata' |project Timestamp, FileName, InitiatingProcessFileName, DeviceId |limit 2"
114110
}
115111
```
116112

0 commit comments

Comments
 (0)