Update NRT_PIMElevationRequestRejected.yaml

Azure · Nov 13, 2023 · 90a4b98 · 90a4b98
1 parent 7557aef
commit 90a4b98
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Solutions/Microsoft Entra ID/Analytic Rules/NRT_PIMElevationRequestRejected.yaml b/Solutions/Microsoft Entra ID/Analytic Rules/NRT_PIMElevationRequestRejected.yaml
@@ -17,7 +17,7 @@ tags:
   - AADSecOpsGuide
 query: |
   AuditLogs
-  | ActivityDisplayName =~'Add member to role request denied (PIM activation)'
+  | where ActivityDisplayName =~ 'Add member to role request denied (PIM activation)'
   | mv-apply ResourceItem = TargetResources on 
     (
         where ResourceItem.type =~ "Role"