Forum Discussion

eladfe's avatar
eladfe
Copper Contributor
Oct 26, 2023

Let statemen wiith a few strings

Hay I want to check if there was some connection to a several URL addresses. so first I want to create a variable with all the URL addresses and the run a query for checking if there was any connec...
juliansperling's avatar
juliansperling
Brass Contributor
Oct 27, 2023

eladfe Depending on the amount of URLs and if you want to reuse them you might want to consider a Watchlist.

Otherwise it would be 

let arr=dynamic(["example.com", "example.org", "example.net", ...]); 

 

  • eladfe's avatar
    eladfe
    Copper Contributor
    Oct 29, 2023
    Thanks!
    Now when I check if a user access to one of the URLs I run the query:
    let arr=dynamic(["example.com", "example.org", "example.net", ...]);
    DeviceNetworkEvents
    | where RemoteUrl has_any (arr)

    but the problem is that the results contains :
    test.example.com
    one.example.com
    two.example.com

    I want only the URL example.com

Resources