Project Nested values in KQL from target resources - azure-data-explorer

Question

I am new to KQL, struggling to project values inside target resources but not able to retrieve the required values can you please help me below.
AuditLogs
| where ActivityDisplayName contains "Update user" and InitiatedBy contains "Testuser"
| where TargetResources contains "Id=xxxxxxxx"
wanted to project id and userprinciplename which are coming inside the targetresources, attached screenshot below link for reference
https://ibb.co/DpzZkks
Sample Json
[{
"id": "xyz",
"displayName": null,
"type": "User",
"userPrincipalName": "ABC",
"modifiedProperties": [{
"displayName": "xxxxxx",
"oldValue": "xxxxx",
"newValue": "yyyyy"
},
{
"displayName": "xxxxx",
"oldValue": "[{xxxx}]",
"newValue": "[{xxxx}]"
},
{
"displayName": "Included Updated Properties",
"oldValue": null,
"newValue": "xxxxx"
},
{
"displayName": "TargetId.UserType",
"oldValue": null,
"newValue": "\"Member\""
}
],
"administrativeUnits": []
}]

Answer 1

if TargetResources is of type string, you can use parse_json() to make it of type dynamic, then access its properties as follows:
| extend TargetResources = parse_json(TargetResources)
| project A = tostring(TargetResources.PropertyA),
B = tolong(TargetResources.PropertyB),
C = TargetResources.PropertyC
if TargetResources is already of type dynamic, you can simply access its properties as shown above, without having to invoke parse_json().
relevant documentation topics:
the dynamic data type
the parse_json() function
for example:
print input = '{"key1":1, "key2":"value2", "key3":{"key4":4.4}}'
| extend input = parse_json(input)
| project v1 = tolong(input.key1),
v2 = tostring(input.key2),
v4 = todouble(input.key3.key4)
v1
v2
v4
1
value2
4.4
UPDATE, based on the provided data sample
when dealing with arrays, you can use mv-expand or mv-apply to expand elements in the arrays for further processing
examples:
examples:
print TargetResources = dynamic([{
"id": "xyz",
"displayName": null,
"type": "User",
"userPrincipalName": "ABC",
"modifiedProperties": [{
"displayName": "xxxxxx",
"oldValue": "xxxxx",
"newValue": "yyyyy"
},
{
"displayName": "xxxxx",
"oldValue": "[{xxxx}]",
"newValue": "[{xxxx}]"
},
{
"displayName": "Included Updated Properties",
"oldValue": null,
"newValue": "xxxxx"
},
{
"displayName": "TargetId.UserType",
"oldValue": null,
"newValue": "\"Member\""
}
],
"administrativeUnits": []
}])
| mv-expand TargetResources
| project TargetResources.id, TargetResources.userPrincipalName
TargetResources_id
TargetResources_userPrincipalName
xyz
ABC
print TargetResources = dynamic([{
"id": "xyz",
"displayName": null,
"type": "User",
"userPrincipalName": "ABC",
"modifiedProperties": [{
"displayName": "xxxxxx",
"oldValue": "xxxxx",
"newValue": "yyyyy"
},
{
"displayName": "xxxxx",
"oldValue": "[{xxxx}]",
"newValue": "[{xxxx}]"
},
{
"displayName": "Included Updated Properties",
"oldValue": null,
"newValue": "xxxxx"
},
{
"displayName": "TargetId.UserType",
"oldValue": null,
"newValue": "\"Member\""
}
],
"administrativeUnits": []
}])
| mv-expand TargetResources
| mv-expand TargetResources.modifiedProperties
| project TargetResources_modifiedProperties
TargetResources_modifiedProperties
{ "displayName": "xxxxxx", "oldValue": "xxxxx", "newValue": "yyyyy"}
{ "displayName": "xxxxx", "oldValue": "[{xxxx}]", "newValue": "[{xxxx}]"}
{ "displayName": "Included Updated Properties", "oldValue": null, "newValue": "xxxxx"}
{ "displayName": "TargetId.UserType", "oldValue": null, "newValue": ""Member""}