SailPointIdentityNowUserWithFailedEvent

Requête originale, sans modification.

declare query_parameters(lbperiod:timespan = 14d, type:string = "ACCESS_ITEM", actorName:string = "test.tester", targetName:string = "test.tester");
  SailPointISC_Events_CL
  | where TimeGenerated > ago(lbperiod)
  | where EventType == type
  | where Status == "FAILED"
  | where ActorName == actorName
  | where TargetName == targetName
  | sort by Created