Kusto dashboard will not order properly

316 Views Asked by At

I'm trying to create a Kusto dashboard for security. I need the pieces of the dashboard to order by severity. But the problem is that if I just order by severity, it doesn't display properly, showing high, low, then medium. Here's a link to the starter kit I'm using: https://techcommunity.microsoft.com/t5/azure-security-center/creating-a-custom-dashboard-for-azure-security-center-with-azure/ba-p/1518647

But I don't want to order by high severity and easy fixes, I want to show all issues ordered by severity, high, medium, and then low. I had this working before, downloaded the dashboard, and then when I went back nothing was right and I found that the json for the dashboard didn't reflect my changes at all. I modified the json to change the names of the verious pinned items. Can someone help with this?

1

There are 1 best solutions below

0
On

Found the solution by way of a lot of reading up on Kusto, I hope this helps someone. Here is how to use the same term but ordering differently:

// Filter
| where Severity == "High" or Severity == "Medium" or Severity == "Low"
| order by Severity == "High" desc, Severity == "Medium", Severity == "Low"