Forum Discussion

Copper Contributor

Mar 14, 2022

Advanced Hunting Query - Negation

I am trying to formulate a query that returns email TLD that are NOT in a specified list.

I have the following query which return those I am interested in:

EmailEvents

| where SenderFromDomain has_any (".com", ".net", ".org", ".uk")

what is the negation of the above statement where I can list the TLDs I am not interested in seeing?

Steel Contributor

Try this.

EmailEvents
| where not(SenderFromDomain  has_any (".com", ".net", ".org", ".uk"))