Forum Discussion

Microsoft

Dec 13, 2021

Solved

Compare a watchlist of IPs to DNS Events

I am trying to compare IOCs from a watchlist in Sentinel to the DnsEvent based on a KQL query. But I am having trouble comparing the two sources. I thought about a union statement, but I can't get around that I have to compare specific columns in two different sources. Does anyone know how to compare results (ips) from a watchlist to DNS events using KQL?

GaryBushey

Dec 13, 2021

agoodson a join would work.

_GetWatchlist('IPAddresses')
| join (DnsEvents) on $left.IPAddress == $right.IPAddresses

1 Reply

GaryBushey
Bronze Contributor
Dec 13, 2021
agoodson a join would work.

_GetWatchlist('IPAddresses') | join (DnsEvents) on $left.IPAddress == $right.IPAddresses