Forum Discussion
MrD
Apr 01, 2026Copper Contributor
Stuck looking up a watchlist value
Hiya, I get stuck working with watchlists sometimes. In this example, I'm wanting to focus on account activity from a list of UPNs. If I split the elements up, I get the individual results, but ca...
MrD
Apr 02, 2026Copper Contributor
I fixed it using this:
| where upn has_any (ServiceAccounts)