Microsoft Security | Microsoft Sentinel
A cloud-native SIEM solution that provides intelligent security analytics and threat detection across systems
How to resolve the error 'union' operator: Failed to resolve table expression named 'Okta_CL'
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 75%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJT%3C/text%3E%3C/svg%3E)
John Tyson
0
Reputation points
I think the underlying issue is that the Okta_CL table in this environment is not populated due to the new okta connection being used which populates OktaV2_CL.
I am using this out of the box Analytics rule Okta Fast Pass Phishing Detection pasted below:
I am not understanding how a Union is being used in this logic, and again I think the real issue is that the product has not been updating Analytics rules that are deployed in the content hub>data connectors.
This is not the first time I've run into this issue with the Okta_CL table, which again is not populated and the OktaV2_CL table is.
OktaSSO
| where eventType_s == 'user.authentication.auth_via_mfa'
| where outcome_result_s == 'FAILURE'
| where outcome_reason_s == 'FastPass declined phishing attempt'
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,
outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', ""), debugContext_debugData_threatSuspected_s, client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, client_geographicalContext_city_s, client_geographicalContext_country_s
| extend Location = strcat(client_geographicalContext_city_s, "-", client_geographicalContext_country_s)
Microsoft Security | Microsoft Sentinel
-
John Tyson 0 Reputation points
2025-10-22T15:24:58.5+00:00 Same issue for the Okta alert rule: High-Risk Admin Activity
let AdminActivity = dynamic(["iam.role.create","iam.role.permissions.add","user.session.access_admin_app","user.mfa.factor.suspend", "user.account.privilege.grant", "group.privilege.grant", "system.api_token.create", "user.session.impersonation.grant"]); let AdminOperations = OktaSSO | where eventType_s in (AdminActivity) | where outcome_result_s =~ 'SUCCESS' | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_userAgent_browser_s, client_device_s, client_userAgent_rawUserAgent_s, client_ipAddress_s, client_geographicalContext_country_s, client_geographicalContext_city_s, displayMessage_s, outcome_result_s, outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', ""), column_ifexists('debugContext_debugData_threatSuspected_s', ""), client_geographicalContext_geolocation_lat_d, client_geographicalContext_geolocation_lon_d, authenticationContext_externalSessionId_s; let HighRiskEvents = OktaSSO | where eventType_s in ('policy.evaluate_sign_on' , 'user.session.start') | extend debugContext_debugData_logOnlySecurityData_s = column_ifexists('debugContext_debugData_logOnlySecurityData_s', '{}') | where parse_json(tostring(parse_json(debugContext_debugData_logOnlySecurityData_s).risk)).level =~ "HIGH" | where outcome_result_s =~ 'SUCCESS' | extend reasons = tostring(parse_json(tostring(parse_json(debugContext_debugData_logOnlySecurityData_s).risk)).reasons) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_userAgent_browser_s, client_device_s, client_userAgent_rawUserAgent_s, client_ipAddress_s, client_geographicalContext_country_s, client_geographicalContext_city_s, displayMessage_s, outcome_result_s, outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', ""), column_ifexists('debugContext_debugData_threatSuspected_s', ""), client_geographicalContext_geolocation_lat_d, client_geographicalContext_geolocation_lon_d, authenticationContext_externalSessionId_s, reasons; AdminOperations | join kind=inner (HighRiskEvents) on actor_displayName_s, client_ipAddress_s, authenticationContext_externalSessionId_s -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 90%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
Pauline Mbabu 1,840 Reputation points Microsoft Employee2025-11-13T16:45:36.7366667+00:00 Hello John Tyson.
Thank you for reaching out.The error
union operator: Failed to resolve table expression named 'Okta_CL'means the query is referencing a table that doesn’t exist in the current Log Analytics workspace.
In Microsoft Sentinel → Data Connectors, confirm that the Okta connector is installed and sending data. If the data connector is correctly installed and receiving data, then check for the Correct Table name. Runshow tablesto confirm ifOkta_CLexists.Why Union Appears in the Rule The out-of-the-box KQL rule often uses:
*union isfuzzy=true Okta_CL, OktaV2_CL
*
This ensures compatibility with both legacy (Okta_CL) and new (OktaV2_CL) connectors. However:- If your environment only populates
OktaV2_CL, the union will still work, but any references to fields unique toOkta_CLmust be normalized. - If normalization is missing, the rule may fail or return incomplete results.
If your environment uses OktaV2_CL only, you should:
- Remove or adjust the union to focus on
OktaV2_CL. - Normalize fields after union using
projectorextendso both tables align.
- If your environment only populates
Sign in to comment
Sign in to answer