Forum Discussion

eladfe's avatar
eladfe
Copper Contributor
Oct 26, 2023

Let statemen wiith a few strings

Hay

I want to check if there was some connection to a several URL addresses.

so first I want to create a variable with all the URL addresses and the run a query for checking if there was any connection to each one of these addressee. 

How can I create a let statement with a few URL addresses, or strings  ? 

Thanks 
Elad

  • juliansperling's avatar
    juliansperling
    Brass Contributor
    Oct 27, 2023

    eladfe Depending on the amount of URLs and if you want to reuse them you might want to consider a Watchlist.

    Otherwise it would be 

    let arr=dynamic(["example.com", "example.org", "example.net", ...]); 

     

    • eladfe's avatar
      eladfe
      Copper Contributor
      Oct 29, 2023
      Thanks!
      Now when I check if a user access to one of the URLs I run the query:
      let arr=dynamic(["example.com", "example.org", "example.net", ...]);
      DeviceNetworkEvents
      | where RemoteUrl has_any (arr)

      but the problem is that the results contains :
      test.example.com
      one.example.com
      two.example.com

      I want only the URL example.com

Resources