From 8d27543c7c656160a664da8f4ce45bc4201b28f1 Mon Sep 17 00:00:00 2001
From: John Duprey <jwd@johnwduprey.com>
Date: Wed, 2 Oct 2024 23:25:19 -0400
Subject: [PATCH] Update Test-CIPPAuditLogRules.ps1

---
 Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1 b/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1
index db024dcbee24..0e300cbac49d 100644
--- a/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1
+++ b/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1
@@ -36,7 +36,7 @@ function Test-CIPPAuditLogRules {
     }
     Write-Information 'Getting audit records from Graph API'
     $SearchResults = Get-CippAuditLogSearchResults -TenantFilter $TenantFilter -QueryId $SearchId
-    $LogCount = ($Data | Measure-Object).Count
+    $LogCount = ($SearchResults | Measure-Object).Count
     Write-Information "Logs to process: $LogCount"
     $Results.TotalLogs = $LogCount
     if ($LogCount -gt 0) {
@@ -129,7 +129,7 @@ function Test-CIPPAuditLogRules {
                     $Data.CIPPHostedIP = $hosting
                     $Data.CIPPIPDetected = $IP
                     $Data.CIPPLocationInfo = ($Location | ConvertTo-Json)
-                    $Data.AuditRecord = ($AuditRecord | ConvertTo-Json)
+                    $Data.AuditRecord = ($RootProperties | ConvertTo-Json)
                 }
                 $Data | Select-Object * -ExcludeProperty ExtendedProperties, DeviceProperties, parameters
             } catch {