Forum Discussion
Solved
Stuck looking up a watchlist value
Hiya, I get stuck working with watchlists sometimes. In this example, I'm wanting to focus on account activity from a list of UPNs. If I split the elements up, I get the individual results, but ca...
I fixed it using this:
| where upn has_any (ServiceAccounts)
I fixed it using this:
| where upn has_any (ServiceAccounts)