AzSentinelQueries icon indicating copy to clipboard operation
AzSentinelQueries copied to clipboard

match-graph doesn't work any more

Open mhobbelen opened this issue 5 months ago • 0 comments

| graph-match (Account)-[HasPathTo*3 .. 9]->(Administrator) where HasPathTo.EdgeType in ("HasSession", "HadSession", "AdminTo") and Administrator.AccountName =~ "Administrator" and Account.ObjectType == "Identity" and Account.Source != Administrator.Source and HasPathTo.Source != HasPathTo.Destination project User = Account.AccountName, Path = HasPathTo.EdgeDisplayName, PathEdges=HasPathTo.EdgeType, DomaindAdmin = Administrator.AccountName | extend PathLength = array_length(Path)

this where clause is failing: graph-match operator: variable edge 'HasPathTo', referenced in graph where clause, should be accessed using 'map', 'all' and 'any' graph functions (see https://aka.ms/deprecation-of-variable-length-edge-dot-notation)

can you update your code example on the blog site?

mhobbelen avatar Aug 26 '25 15:08 mhobbelen