SC-200 Practice Question 3829
Exam: SC-200
Domain: Perform threat hunting
Difficulty: medium
You need to parse a dynamic JSON string payload located in the `AdditionalFields` column of a log table in KQL to extract a specific property named `SubStatus`. Which KQL function or operator should you use?
Answer Options
A
The `parse_json()` scalar function or `todynamic()`
B
The `count()` aggregation function
C
The `trim()` string function
D
The `strcat()` concatenation operator
Correct Answer
A: The `parse_json()` scalar function or `todynamic()`
Explanation
The `parse_json()` scalar function or `todynamic()` converts a valid JSON string into a dynamic object, allowing property extraction using dot notation (e.g., `parse_json(AdditionalFields).SubStatus`).