Disks Alerts From Prancer

Original query, unchanged.

union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Compute/disks'
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot 
| extend
  id = tostring(snapshot.id),
  structure = tostring(snapshot.structure),
  reference = tostring(snapshot.reference),
  source = tostring(snapshot.source),
  collection = tostring(snapshot.collection),
  type = tostring(snapshot.type),
  region = tostring(snapshot.region),
  resourceTypes = tostring(snapshot.resourceTypes),
  path = tostring(snapshot.path)