azure - KQL 查询显示特定日志中的先前日志

Question

我正在处理一个查询，我需要其中包含“Compromied”消息的日志，然后我希望它返回前面的 5 个“deny”日志。 KQL 新手，只是不知道运算符(operator)，所以我感谢您的帮助!

当前查询:

| sort by TimeGenerated
| where SourceIP == "555.555.555.555"
| where TimeGenerated between (datetime(10/20/2021, 16:25:41.750).. datetime(10/20/2021, 16:35:41.750))
| where AdditionalExtensions has "Compromised" or DeviceAction == "deny"

理想情况下，在我的脑海中它会是这样的:

需要查询:

| sort by TimeGenerated
| where SourceIP == "555.555.555.555"
| where AdditionalExtensions has "Compromised"  
| \\show preceding 5 logs that have DeviceAction = "deny"

谢谢!

Answer 1

您可以使用 prev() 函数