diff --git a/Parsers/SQLSever/SQLServer_Parser.txt b/Parsers/SQLSever/SQLServer_Parser.txt index e59a2eac910..0d1b3965e69 100644 --- a/Parsers/SQLSever/SQLServer_Parser.txt +++ b/Parsers/SQLSever/SQLServer_Parser.txt @@ -15,7 +15,7 @@ // Detailed Blog on Monitoring SQL Server with Azure Sentinel : https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-sql-server-with-azure-sentinel/ba-p/1502960 // let SQlData = Event -| where Source has "MSSQL" +| where Source contains "MSSQL" ; let Sqlactivity = SQlData | where RenderedDescription !has "LGIS" and RenderedDescription !has "LGIF"