Azure Log Analytics 'where' operator: Failed to resolve table or column expression named 'SecurityEvent'

Whenever I attempt to run the following Log Analytic query in Azure Log Analytics I get the following error:

'where' operator: Failed to resolve table or column expression named 'SecurityEvent'

I think it's because I need to enable SecurityEvent in Log Analytics but I'm not sure. I was wondering if someone could provide a guide;

SecurityEvent 
| where AccountType == "User" and EventID == 4625 and TimeGenerated > ago(6h) 
| summarize IPCount = dcount(IpAddress), makeset(IpAddress)  by Account
| where IPCount > 5
| sort by IPCount desc

Assuming that you are using the free version of security centre, there is no "SecurityEvent" item. You can use the schema explorer in Log Analytics to see that:

enter image description here

Azure Log Analytics 'where' operator: Failed to resolve table or column expression named 'SecurityEvent'

Related

Recent Posts