In the blog post “Active Lists out; make_list() in,” Ofer_Shezaf referred to one of the uses of Active Lists (ArcSight) or reference sets (QRadar), namely implementing correlation. But Active Lists, ...
Updated Apr 04, 2021
Version 19.0
Blog Post
Ofer_Shezaf
Microsoft
Microsoft
You can either:
1. Use the join operator described above.
2. Use the "!in~" or concatenated values like this:
let list = toscalar (mydatable | summarize make_list(strcat (col1, "|", col2)));
....
| where strcat (col1, "|", col2) !in~ (list)