Skip to content

Commit f5d2175

Browse files
Update attack-surface-reduction-rules-deployment-operationalize.md
Syntax error in one of the KQL examples preventing query from running and throwing error message.
1 parent ca79534 commit f5d2175

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

defender-endpoint/attack-surface-reduction-rules-deployment-operationalize.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ If you want to focus on the AsrOfficeChildProcess rule and get details on the ac
7373

7474
```kusto
7575
DeviceEvents
76-
| where (Actiontype startswith "AsrOfficechild")
76+
| where (ActionType startswith "AsrOfficechild")
7777
| extend RuleId=extractjson("$Ruleid", AdditionalFields, typeof(string))
7878
| project DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
7979
```

0 commit comments

Comments
 (0)