ReportMagic

[Azure.LogAnalyticsTable:]

Inserts a query response.

Purpose

Inserts a query response. For more information about constructing Sentinel queries, see https://github.com/reprise99/Sentinel-Queries.

Compatibility

The macro can be used in the highlighted input document types only. A greyed-out icon indicates not supported.

Parameters (51)

Grouped View

Mandatory (1)

Parameter	Type	Purpose	Options	Default
query	String	The query to use.	N/A	N/A

Behaviour (1)5 additional

Parameter	Type	Presence	Purpose	Options	Default
hidden	Boolean	Optional	If true, the table will not be written to the report. This is useful if you want to use a Table macro in PowerPoint (which does not support adding tables) but have XLSX output enabled on the Schedule. This way the macro will produce a Success rather than Macro Error and the XLSX output will be generated.	true false	false

Additional (5)

Parameter	Type	Presence	Purpose	Options	Default
errorOnOverflow	Boolean	Optional	Should NCalc expression evaluation throw error on Overflow	true false	true
if	String	Optional	The condition that must be true in order for the macro to be executed/evaluated. Must either evaluate to true or false, for example: "3+5=8" or "contains('abcd', 'z').	N/A	true
mode	MacroMode	Optional	The mode in which variables are stored. In the legacy mode (default for Schedules), the variable created is a string and formatted. In the normal mode (default for Report Studio), the output variable is stored as a strongly-typed theObject, e.g. an Int32 or a List etc., rather than a formatted string.	Legacy Normal	Legacy
obfuscation	ObfuscationType	Optional	Obfuscation type. Use obfuscation to write reports where sensitive data is hidden. When used, ReportMagic guarantees that the same input string will map to the same output string for the whole of the report (but the next time the report runs, it will most likely map to a different value). If you use obfuscation, the property in your macro will not show up and instead, you will see a fake item of the obfuscation type chosen.	None UkTown DeviceName Company IpAddress PrivateIpAddress	None
warning	String	Optional	If specified, adds a warning message for this macro. This is processed as an NCalc, and the warning message will ALWAYS be present and will be the value of the evaluated NCalc expression.	N/A	N/A

Colours (2)

Parameter	Type	Presence	Purpose	Options	Default
normalCellColor	Color	Optional	The cell color to use when no issue exists. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	N/A
normalCellTextColor	Color	Optional	The cell text color to use when no issue exists. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	N/A

Formatting (8)

Parameter	Type	Presence	Purpose	Options	Default
autoFit	AutoFitBehavior	Optional	The Word autofit behaviour. If omitted, no change is made.	Content Fixed Window	Content
columnAlignments	List<String>	Optional	The column alignments. If fewer alignments are made than the number of columns, the last given value is used for the remaining columns. If omitted, no change is made. Supported values: Left, Right and Center. Usage: columnAlignments=Left;Right;Center;...In Excel output files, columns may be automatically aligned based on their type (e.g. numbers are always right-justified), and all column headers are ALWAYS left-justified so their text is not obscured by filter drop-down arrows in the Excel UI.	N/A	N/A
fontSize	Double	Optional	Override the table style's font size. This is achieved by setting the font size for each table cell.	From 4 to 50	N/A
format	CellFormat	Optional	The cell format to use. Options are: 'AllStrings', 'Auto' or 'NumbersAsStrings'. Auto automatically sets the format for the whole column, or it can be forced to a string with AllStrings. To preserve date / time formatting (with dateTimeFormat) but treat only number columns as strings, use NumbersAsStrings.	Auto AllStrings NumbersAsStrings	Auto
horizontalAlignment	TableHorizontalAlignment	Optional	The horizontal alignment of the table on the page (does not affect Excel output).	Left Center Right	Left
pageWidthPercent	Double	Optional	The percentage of the available page that the table should occupy.	From 0 to 150	N/A
style	String	Optional	Use Word's built in Table Styles (such as Grid Table 2 - Accent 1), or make your own in the Report Template. Built-in styles can be used in any document. Note that any custom styles you create, or customisations to the standard styles required that the styles exist in the input template XML (because they are not saved in Word documents by default). This can be achieved by assigning the style to a table, then delete the table and save the document.	N/A	Table Grid
xlsxTableStyle	XlsxTableStyle	Optional	The XLSX table style to use in any XLSX output document.	TableStyleMedium13 None TableStyleDark1 TableStyleDark10 TableStyleDark11 TableStyleDark2 TableStyleDark3 TableStyleDark4 TableStyleDark5 TableStyleDark6 TableStyleDark7 TableStyleDark8 TableStyleDark9 TableStyleLight1 TableStyleLight10 TableStyleLight11 TableStyleLight12 TableStyleLight13 TableStyleLight14 TableStyleLight15 TableStyleLight16 TableStyleLight17 TableStyleLight18 TableStyleLight19 TableStyleLight2 TableStyleLight20 TableStyleLight21 TableStyleLight3 TableStyleLight4 TableStyleLight5 TableStyleLight6 TableStyleLight7 TableStyleLight8 TableStyleLight9 TableStyleMedium1 TableStyleMedium10 TableStyleMedium11 TableStyleMedium12 TableStyleMedium14 TableStyleMedium15 TableStyleMedium16 TableStyleMedium17 TableStyleMedium18 TableStyleMedium19 TableStyleMedium2 TableStyleMedium20 TableStyleMedium21 TableStyleMedium22 TableStyleMedium23 TableStyleMedium24 TableStyleMedium25 TableStyleMedium26 TableStyleMedium27 TableStyleMedium28 TableStyleMedium3 TableStyleMedium4 TableStyleMedium5 TableStyleMedium6 TableStyleMedium7 TableStyleMedium8 TableStyleMedium9	TableStyleMedium13

Conditional Formatting (10)

Parameter	Type	Presence	Purpose	Options	Default
criticalCellColor	Color	Optional	The critical cell background color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	Color [A=255, R=192, G=0, B=0]
criticalCellTextColor	Color	Optional	The critical cell text color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	N/A
errorCellColor	Color	Optional	The error cell background color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	Color [A=255, R=240, G=128, B=0]
errorCellTextColor	Color	Optional	The error cell text color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	N/A
fatalCellColor	Color	Optional	The fatal cell background color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	Color [A=255, R=150, G=0, B=0]
fatalCellTextColor	Color	Optional	The fatal cell text color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	N/A
infoCellColor	Color	Optional	The info cell background color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	Color [A=255, R=0, G=213, B=213]
infoCellTextColor	Color	Optional	The info cell text color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	N/A
warningCellColor	Color	Optional	The warning cell background color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	Color [A=255, R=240, G=192, B=0]
warningCellTextColor	Color	Optional	The warning cell text color to use. If omitted, no change is made. Affects a cell or row based on the ThresholdAffects parameter.	A named color or an HTML-encoded color .Note that 'transparent' is a valid color that you can use in any macro parameter that expects a color.	N/A

Time & Date (1)

Parameter	Type	Presence	Purpose	Options	Default
dateTimeFormat	String	Optional	The date/time format to use. Use the format specified here: https://docs.microsoft.com/en-us/dotnet/standard/base-types/custom-date-and-time-format-strings. When the format parameter is set to AllStrings, this is ignored unless you use NumbersAsStrings. Note however that this parameter only has an effect if all the values in the column are the same type.	N/A	yyyy-MM-dd

Filtering & Sorting (5)

Parameter	Type	Presence	Purpose	Options	Default
query	String	Mandatory	The query to use.	N/A	N/A
includeCondition	String	Optional	The condition on which each row is included. Fields should be referred to based on the column name in curly braces, for example: includeCondition ='{CreatedOn}'>'{StartOfLastMonth}'.	N/A	N/A
orderBy	String	Optional	If present, sorts alphanumerically by this column.	N/A	N/A
orderByDescending	String	Optional	If present, sorts reverse alphanumerically by this column.	N/A	N/A
take	Int32	Optional	Only display up to this number of rows.	From 0 to 2147483647	N/A

Output (2)2 additional

Parameter	Type	Presence	Purpose	Options	Default
emptyTableText	String	Optional	If present, and the table has no rows, the specified text will be inserted in place of the table.	N/A	N/A
writeToSpreadsheet	Boolean	Optional	Whether to output the result in the output Excel document (if so configured).	true false	true

Additional (2)

Parameter	Type	Presence	Purpose	Options	Default
failureText	String	Optional	The text to display should the macro fail to execute. Note that a poorly-specified macro (e.g. omitting mandatory parameters) will still result in an error message.	N/A	N/A
failureVariable	String	Optional	The name of a variable to create should the macro fail to execute. The variable will be a text variable, and will contain either the failure text (only if the failureText parameter is set), otherwise it will contain the exception / failure message.	N/A	N/A

General (7)4 additional

Parameter	Type	Presence	Purpose	Options	Default
columns	List<String>	Optional	The column names to show. If the columns parameter is not specified, the Macro's default will be used.	N/A	N/A
deCamelCaseHeaderRow	Boolean	Optional	Whether to de-camel-case the header row (i.e. convert 'MyHeaderText' to 'My Header Text'.	true false	false
repeatHeaderPerPage	Boolean	Optional	Whether to repeat the header row at the beginning of each page.	true false	true
tableName	String	Optional	The table name (e.g. for XLSX output)	N/A	Table
thresholdAffects	ThresholdAffects	Optional	What the threshold affects.	Cell Row	Cell
thresholdColumn	String	Optional	The threshold column.	N/A	N/A
worksheetName	String	Optional	The worksheet to save the result in the output Excel document (if so configured). Excel does not allow blank names, names above 31 characters, and the following characters: :, /, \, ?, *, [, ]	N/A	Table

Additional (4)

Parameter	Type	Presence	Purpose	Options	Default
comment	String	Optional	Add a comment to make your document template more readable. The comment is discarded in the output document.	N/A	N/A
desiredExecutionResult	ExecutionResult	Optional	If specified, asserts the expected execution result of the macro. The macro executes normally; if the actual result matches the desired value, the result is converted to Success. If the actual result does not match, the result is converted to MacroError with a descriptive message. This is primarily used for testing and diagnostic purposes. Valid values are: Unknown, Success, MacroError, WorkerStopped, Running, Warning, NeverRun, Cancelled, Pending, Paused, SystemError, Deferred, Stopped.	Cancelled Deferred MacroError NeverRun Paused Pending Running Stopped Success SystemError Warning WorkerStopped	N/A
expectedType	String	Optional	If specified, asserts the expected output type of the macro result. The macro executes normally; if the actual type does not match, a macro error is generated. Requires 'storeAs', 'storeAsHidden', or 'storeFormattedValueAs' to be set for typed validation. Valid types include CLR names (e.g. Int32, Int64, Single, Double, Boolean, String, JArray, JObject) and C# keyword aliases (e.g. int, long, float, double, bool, string, uint, ulong, short, ushort, byte, sbyte, decimal, char, object). The special value 'Number' matches any numeric type.	N/A	N/A
expectedValue	String	Optional	If specified, asserts the expected output value of the macro result. The macro executes normally; if the actual value does not match, a macro error is generated. When 'storeAs' or 'storeAsHidden' is set, the stored variable value is compared. Otherwise, the document output text is compared.	N/A	N/A

Deprecated (4)

Parameter	Type	Preferred Parameter	Purpose	Options	Default
alignment	List<String>	columnAlignments	The column alignments. If fewer alignments are made than the number of columns, the last given value is used for the remaining columns. If omitted, no change is made. Supported values: Left, Right and Center. Usage: columnAlignments=Left;Right;Center;...In Excel output files, columns may be automatically aligned based on their type (e.g. numbers are always right-justified), and all column headers are ALWAYS left-justified so their text is not obscured by filter drop-down arrows in the Excel UI.	N/A	N/A
alignments	List<String>	columnAlignments	The column alignments. If fewer alignments are made than the number of columns, the last given value is used for the remaining columns. If omitted, no change is made. Supported values: Left, Right and Center. Usage: columnAlignments=Left;Right;Center;...In Excel output files, columns may be automatically aligned based on their type (e.g. numbers are always right-justified), and all column headers are ALWAYS left-justified so their text is not obscured by filter drop-down arrows in the Excel UI.	N/A	N/A
autofit	AutoFitBehavior	autoFit	The Word autofit behaviour. If omitted, no change is made.	Content Fixed Window	Content
topN	Int32	take	Only display up to this number of rows.	From 0 to 2147483647	N/A

Examples (4)

Example 1

This example displays full information about security events in the last minute.

[Azure.LogAnalyticsTable: workspaceId=00000000-0000-0000-0000-000000000000, query=`SecurityEvent | where TimeGenerated > ago (1m)`]

Example 2

This example displays summary information about security events in the last minute.

[Azure.LogAnalyticsTable: workspaceId=00000000-0000-0000-0000-000000000000, query=`SecurityEvent | where TimeGenerated > ago (1m)`, columns=EventID;Activity]

Example 3

Security Alerts between two dates.

[Azure.LogAnalyticsTable: workspaceId=00000000-0000-0000-0000-000000000000, query=`SecurityAlert | where TimeGenerated between (datetime(2024-03-01) .. datetime(2024-04-01))`]

Example 4

All events between two dates.

[Azure.LogAnalyticsTable: workspaceId=00000000-0000-0000-0000-000000000000, query=`SecurityAlert | where TimeGenerated between (datetime(2024-03-01) .. datetime(2024-04-01)) | summarize Count=count() by AlertName | sort by Count`]