ChristopherKerry
Mar 31, 2021Copper Contributor
Wildcard filtering using a watchlist
Hey all,
I'm trying to do something like the below:
Table
| where Dest !endswith ((_GetWatchlist('watchlist') | project Dest))
However I get an error saying that "StringNotEndsWith operator requires string arguments"
Any idea how to search a watchlist like this?? Many thanks in advance.
ChristopherKerry Try surrounding the entire expression with not() as in
Heartbeat | where not(ComputerIP has_any("192.168.1.1"))