Forum Discussion

eladfe's avatar
eladfe
Copper Contributor
Oct 26, 2023

Let statemen wiith a few strings

Hay I want to check if there was some connection to a several URL addresses. so first I want to create a variable with all the URL addresses and the run a query for checking if there was any connec...
juliansperling's avatar
juliansperling
Brass Contributor

eladfe Depending on the amount of URLs and if you want to reuse them you might want to consider a Watchlist.

Otherwise it would be 

let arr=dynamic(["example.com", "example.org", "example.net", ...]); 

 

eladfe's avatar
eladfe
Copper Contributor
Oct 29, 2023
Thanks!
Now when I check if a user access to one of the URLs I run the query:
let arr=dynamic(["example.com", "example.org", "example.net", ...]);
DeviceNetworkEvents
| where RemoteUrl has_any (arr)

but the problem is that the results contains :
test.example.com
one.example.com
two.example.com

I want only the URL example.com

Resources