KQL查询访问含点号JSON键名时的点号转义方法

KQL 访问动态类型的JSON结构时，点表示法默认将.识别为层级分隔符。当键名本身包含.（比如示例中的2.0、3.0），无论用反斜杠怎么转义点号，点表示法都会把键名拆成多层路径解析，最终匹配不到目标字段。

访问带特殊字符的键名不需要在点路径里转义，直接用方括号索引语法，把完整键名作为字符串放在方括号内即可。
原查询中出错的字段提取行：

cvss2Score = tostring(properties.additionalData.cvss.\(2.0).base)

替换为以下写法即可正常取值：

cvss2Score = tostring(properties.additionalData.cvss["2.0"].base)

如果需要同时提取CVSS 3.0的基础分，用相同语法即可：

cvss3Score = tostring(properties.additionalData.cvss["3.0"].base)

securityresources 
| where type =~ "microsoft.security/assessments/subassessments"
| extend assessmentKey=extract(@"(?i)providers/Microsoft.Security/assessments/([^/]*)", 1, id), 
        QID=tostring(properties.id), 
        parentResourceId= extract("(.+)/providers/Microsoft.Security", 1, id)
| extend resourceId = tostring(properties.resourceDetails.id)
| where properties.additionalData.assessedResourceType =~ "ServerVulnerability" 
        or properties.additionalData.assessedResourceType =~ "GeneralVulnerability"
| where properties.additionalData.source =~ "Built-in Qualys vulnerability assessment"
| extend vulnerabilityName=tostring(properties.displayName),
        vulnerabilityType = tostring(properties.additionalData.assessedResourceType),
        virtualMachineName=split(properties.resourceDetails.id, "/")[-1],
        cvss2Score = tostring(properties.additionalData.cvss["2.0"].base),
        cvss3Score = tostring(properties.additionalData.cvss["3.0"].base)
| project QID, vulnerabilityName, virtualMachineName, vulnerabilityType, cvss2Score, cvss3Score

提示：所有键名包含空格、斜杠、点号等特殊字符的场景，都可以用方括号传字符串键名的方式访问，兼容性比点表示法更强。

内容的提问来源于stack exchange，提问作者Aziz