In the blog post “Active Lists out; make_list() in,” Ofer_Shezaf referred to one of the uses of Active Lists (ArcSight) or reference sets (QRadar), namely implementing correlation. But Active Lists, ...
Updated Apr 04, 2021
Version 19.0
Blog Post
I have 2 columns in my datatable both are string values. I need to whitelist both the column name values in my query. If I have one column in mydatable, I am able to use "| where mycolumn !in~(mydatable)" but how to whitelist both column name values which occur in a single row. If the column name values doesn't occur in the same row, I would like to see them. Thanks in advance.