DeviceEvents
| where ActionType == "TamperingAttempt"
| extend AdditionalInfo = parse_json(AdditionalFields)
| extend Status = AdditionalInfo.['Status']
| extend Target = AdditionalInfo.['Target']
DeviceEvents
| where ActionType == "TamperingAttempt"
| extend AdditionalInfo = parse_json(AdditionalFields)
| extend Status = AdditionalInfo.['Status']
| extend Target = AdditionalInfo.['Target']