Filter on multiple operations

[DanielSjogrenPermobil]

Adding a filter on one Operation works.
If adding multiple lines, it only uses the last line.

How to add multiple operations?

`
filter:

Audit.AzureActiveDirectory:

  Operation: Change user license.

  Operation: Add user.

  Operation: Change user password.

`

[garethhumphriesgkc]

Config is a yaml file - you're specifying the 'Operation' parameter three times, so each one is overwriting the one before.
I'm not sure what the syntax of the filter is (is that documented somewhere), but maybe something like:

Audit.AzureActiveDirectory:
  Operation: '"Change user license." || "Add user." || "Change user password."'

or

Audit.AzureActiveDirectory: |
  Operation: Change user license.
  Operation: Add user.
  Operation: Change user password.

Will have better success. Basically, find a way to include all your filters under one Operation key.

[DanielSjogrenPermobil]

Thanks for replying. After a lot of testing and asking various AI for tips, I got it to work. Sharing the working code:

Audit.AzureActiveDirectory:
  conditions:
    - attribute: "Operation"
      operator: "equals"
      value: "Add user."
    - attribute: "Operation"
      operator: "equals"
      value: "Change user license."
    - attribute: "Operation"
      operator: "equals"
      value: "Change user password."
  condition: or