This is not capturing the whole statement, it gets truncated.
|
"statement:" Statement:string |
To fix I added the next field extraction below it:
| parse RenderedDescription with * "database_name:" DatabaseName:string
"schema_name:" Temp:string
"object_name:" ObjectName:string
"statement:" Statement:string
"additional_information:" AdditionalInfo:string
"." *
This is not capturing the whole statement, it gets truncated.
Azure-Sentinel/Parsers/SQLSever/SQLServer_Parser.txt
Line 31 in 28c966e
To fix I added the next field extraction below it: