Parameter passing to KQL functions in Defender XDR – Body of the callable expression cannot be empty
Hi all,
In the name of maintainability, I’m trying to create functions so I don’t need to repeat myself in queries and they can all be maintained in one place.
For example, I’d like to create a function that maps a device name back to the last logged in user.
This works fine if its a query, (that is it returns results as expected if I call the function after the definition in the same file) e.g.
However, if i try saving this as a function, and then calling that from another query, I get this error:
Can anyone explain what I’m doing wrong? I’ve tried a simpler example, which also gives me the same error:
Can anyone identify what I’m doing wrong here?
Cheers,
Mitch
Hi all, In the name of maintainability, I’m trying to create functions so I don’t need to repeat myself in queries and they can all be maintained in one place. For example, I’d like to create a function that maps a device name back to the last logged in user. This works fine if its a query, (that is it returns results as expected if I call the function after the definition in the same file) e.g. However, if i try saving this as a function, and then calling that from another query, I get this error: Can anyone explain what I’m doing wrong? I’ve tried a simpler example, which also gives me the same error: Can anyone identify what I’m doing wrong here?Cheers, Mitch Read More