Skip to content

Commit e60bb6b

Browse files
committed
Learn Editor: Update run-advanced-query-api.md
1 parent a21c941 commit e60bb6b

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

defender-endpoint/api/run-advanced-query-api.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,13 +105,11 @@ POST https://api.securitycenter.microsoft.com/api/advancedqueries/run
105105
```
106106

107107
```json
108+
108109
{
109-
"Query":"DeviceProcessEvents
110-
|where InitiatingProcessFileName =~ 'powershell.exe'
111-
|where ProcessCommandLine contains 'appdata'
112-
|project Timestamp, FileName, InitiatingProcessFileName, DeviceId
113-
|limit 2"
110+
"Query":"DeviceProcessEvents |where InitiatingProcessFileName =~ 'powershell.exe' |where ProcessCommandLine contains 'appdata'|project Timestamp, FileName, InitiatingProcessFileName, DeviceId|limit 2"
114111
}
112+
115113
```
116114

117115
### Response example

0 commit comments

Comments
 (0)