HOw to resolve the error'where' operator: Failed to resolve table or column expression named 'Okta_CL' for Analytics rule User Session Impersonation(Okta)
Name is User Session Impersonation(Okta)
Logic is :
Okta_CL
| where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"
// Expand the JSON array in 'target_s' field to extract detailed information about the event
| mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array
// Enhance visibility by extending columns with extracted details for better analysis
| extend TargetUser_id = tostring(parsed_json.id),
TargetUser_type = tostring(parsed_json.type),
TargetUser_alternateId = tostring(parsed_json.alternateId),
TargetUser_displayName = tostring(parsed_json.displayName),
Target_detailEntry = tostring(parsed_json.detailEntry)
// Project event details to gain insights into the security context, including actor and target user information
| project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId,
TargetUser_displayName, TargetUser_type, TargetUser_id,
eventType_s, outcome_result_s
Original Error is:
'where' operator: Failed to resolve table or column expression named 'Okta_CL'
IF I edit the table to OktaSSO i get the error:
'union' operator: Failed to resolve table expression named 'Okta_CL'
If I edit the table to OktaV2_CL which is present in the system due to using the recommended modern Okta collector I get the following error:
Semantic error
Error message'where' operator: Failed to resolve column or scalar expression named 'eventType_s'
Line1
Position0
I ended up using this for the logic but am unsure if it correlates to the original logic:
OktaV2_CL
| where LegacyEventType == "user.session.impersonation.initiate" and OriginalOutcomeResult == "SUCCESS"
// Expand the JSON array in 'target_s' field to extract detailed information about the event
| mv-expand parsed_json = todynamic(OriginalTarget) // Unpack and understand the details from the 'target_s' JSON array
// Enhance visibility by extending columns with extracted details for better analysis
| extend TargetUser_id = tostring(parsed_json.id),
TargetUser_type = tostring(parsed_json.type),
TargetUser_alternateId = tostring(parsed_json.alternateId),
TargetUser_displayName = tostring(parsed_json.displayName),
Target_detailEntry = tostring(parsed_json.detailEntry)
// Project event details to gain insights into the security context, including actor and target user information
| project TimeGenerated, ActorUserId, ActorDisplayName, TargetUser_alternateId,
TargetUser_displayName, TargetUser_type, TargetUser_id,
LegacyEventType, OriginalOutcomeResult