Commit c222639
authored
Update run-advanced-query-api.md
With the query format given as it was, one gets an error like the one below:
{
"error": {
"code": "InvalidRequestBody",
"message": "Missing query.",
"target": "|cd9f5106-4aa2341c0de87fd0.1.2."
}
}
Correct request body is a one liner:
{
"Query": "DeviceProcessEvents | where InitiatingProcessFileName =~ 'powershell.exe'| where ProcessCommandLine contains 'appdata'| project Timestamp, FileName, InitiatingProcessFileName, DeviceId |limit 2"
}1 parent 4919a5a commit c222639
1 file changed
+1
-5
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
106 | 106 | | |
107 | 107 | | |
108 | 108 | | |
109 | | - | |
110 | | - | |
111 | | - | |
112 | | - | |
113 | | - | |
| 109 | + | |
114 | 110 | | |
115 | 111 | | |
116 | 112 | | |
| |||
0 commit comments