以下是一些选项

// Sample data generation. Not part of the solution.
let SecurityAlert = datatable(ProviderName:string, Entities:dynamic)
[
    "IPC", dynamic([{"AadUserID":"Dummy"}])
];
// Solution starts here
SecurityAlert 
| where ProviderName contains "IPC"
| project tostring(Entities[0].AadUserID)

| 实体_0_AadUserID|
| - -|
| 虚拟|
Fiddle

// Sample data generation. Not part of the solution.
let SecurityAlert = datatable(ProviderName:string, Entities:dynamic)
[
    "IPC", dynamic([{"AadUserID":"Dummy"}])
];
// Solution starts here
SecurityAlert 
| where ProviderName contains "IPC"
| mv-expand Entities
| project tostring(Entities.AadUserID)
| where isnotempty(Entities_AadUserID)

| 实体_AadUserID|
| - -|
| 虚拟|
Fiddle

// Sample data generation. Not part of the solution.
let SecurityAlert = datatable(ProviderName:string, Entities:dynamic)
[
    "IPC", dynamic([{"AadUserID":"Dummy"}])
];
// Solution starts here
SecurityAlert 
| where ProviderName contains "IPC"
| mv-apply Entities on (summarize make_set(Entities.AadUserID))
| project set_Entities_AadUserID

| 设置实体AadUserID|
| - -|
| [“虚拟”]|
Fiddle