Blog Post

Microsoft Sentinel Blog
7 MIN READ

Approximate, partial and combined lookups in Azure Sentinel

Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
May 16, 2020
Many of you found Nir Gafni's "Implementing Lookups in Azure Sentinel" article useful. A common question you made was how to lookup partial values. For example, does the account name matches a list o...
Updated Jul 06, 2020
Version 6.0
akshay25june's avatar
akshay25june
Copper Contributor
Aug 22, 2024

I have created watchlist of domain and apply to _Im_Dns table. So i am getting the result if exact match in DnsQuery column. Like in my watchlist if microsoft.com is dynamic domain then it getting result only when DnsQuery column has microsoft.com. But my concern is that i want to get result if DnsQuery column has xyz.microsoft.com.Abc.

 

let DynamicDns = _GetWatchlist('dynamic_dns') | project  SearchKey;

_Im_Dns

| where DnsQuery in~ (DynamicDns)

 

My watchlist have 30k+ dynamic DNS. Kindly suggest us.