Forum Discussion

agoodson's avatar
agoodson
Icon for Microsoft rankMicrosoft
Dec 13, 2021
Solved

Compare a watchlist of IPs to DNS Events

I am trying to compare IOCs from a watchlist in Sentinel to the DnsEvent based on a KQL query. But I am having trouble comparing the two sources. I thought about a union statement, but I can't get ar...
  • GaryBushey's avatar
    GaryBushey
    Dec 13, 2021

    agoodson a join would work. 

     

    _GetWatchlist('IPAddresses')
| join (DnsEvents) on $left.IPAddress == $right.IPAddresses
GaryBushey's avatar
GaryBushey
Bronze Contributor
Dec 13, 2021

agoodson a join would work. 

 

_GetWatchlist('IPAddresses')
| join (DnsEvents) on $left.IPAddress == $right.IPAddresses