HOw to resolve the error'where' operator: Failed to resolve table or column expression named 'Okta_CL' for Analytics rule User Session Impersonation(Okta)

John Tyson 0 Reputation points
2025-10-22T17:46:51.8866667+00:00

Name is User Session Impersonation(Okta)
Logic is :

Okta_CL
| where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"
// Expand the JSON array in 'target_s' field to extract detailed information about the event
| mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array
// Enhance visibility by extending columns with extracted details for better analysis
| extend TargetUser_id = tostring(parsed_json.id), 
         TargetUser_type = tostring(parsed_json.type), 
         TargetUser_alternateId = tostring(parsed_json.alternateId), 
         TargetUser_displayName = tostring(parsed_json.displayName), 
         Target_detailEntry = tostring(parsed_json.detailEntry) 
// Project event details to gain insights into the security context, including actor and target user information
| project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, 
               TargetUser_displayName, TargetUser_type, TargetUser_id, 
               eventType_s, outcome_result_s

Original Error is:
'where' operator: Failed to resolve table or column expression named 'Okta_CL'

IF I edit the table to OktaSSO i get the error:
'union' operator: Failed to resolve table expression named 'Okta_CL'

If I edit the table to OktaV2_CL which is present in the system due to using the recommended modern Okta collector I get the following error:
Semantic error

Error message'where' operator: Failed to resolve column or scalar expression named 'eventType_s'

Line1

Position0

I ended up using this for the logic but am unsure if it correlates to the original logic:

OktaV2_CL
| where LegacyEventType == "user.session.impersonation.initiate" and OriginalOutcomeResult == "SUCCESS"
// Expand the JSON array in 'target_s' field to extract detailed information about the event
| mv-expand parsed_json = todynamic(OriginalTarget) // Unpack and understand the details from the 'target_s' JSON array
// Enhance visibility by extending columns with extracted details for better analysis
| extend TargetUser_id = tostring(parsed_json.id), 
         TargetUser_type = tostring(parsed_json.type), 
         TargetUser_alternateId = tostring(parsed_json.alternateId), 
         TargetUser_displayName = tostring(parsed_json.displayName), 
         Target_detailEntry = tostring(parsed_json.detailEntry) 
// Project event details to gain insights into the security context, including actor and target user information
| project TimeGenerated, ActorUserId, ActorDisplayName, TargetUser_alternateId, 
               TargetUser_displayName, TargetUser_type, TargetUser_id, 
               LegacyEventType, OriginalOutcomeResult

Microsoft Security | Microsoft Sentinel
{count} votes

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.