Forum Discussion
call all watchlist column entity in incident.
We have created watchlist which is having 3 column. So if any incident is triggered from watchlist, we should get all entities in incident. We have created watchlist based on ThreatIntel. It have 3 c...
You will not be able to have anything in the incident that is not part of the analytic rule unless you add it as a comment later. I would suggest having all that information added as entities (or at least one entity that is a JSON array) so you can access it in the Incident itself.
This is below query .
let Watchlist = (_GetWatchlist('xyz')
| project SearchKey);
DeviceNetworkEvents
| where LocalIP in (Watchlist) or RemoteIP in (Watchlist)below is watchlist column which are IPAddress,Provider and MalwareName. how all column included to above query.
- Get rid of the "project" statement if you want to see all the columns. The "project" statement will only show those columns that are included as part of the statement ("SearchKey" in this case)
