Forum Discussion

MichaelJMelone's avatar
MichaelJMelone
Icon for Microsoft rankMicrosoft
Aug 05, 2020

Share Your Hunting Challenges!

Hello world! Tali Ash and I would love your input on anything you would like demo'ed in future webcasts! Want to see us demonstrate a specific hunting capability? Got a query challenge on your mind? ...
MichaelJMelone's avatar
MichaelJMelone
Icon for Microsoft rankMicrosoft
Jan 28, 2021

Citizen8675309 I tried this out in my lab environment and it ran without issue (I set Threshold to 0 for testing)

 

m00nfish1400's avatar
m00nfish1400
Copper Contributor
May 03, 2023

MichaelJMelone 

 

Hi Michael, I just started to learn KQL queries and watched your old webinars on Youtube. Those videos are great learning resources.  When I saw this original post, I was wondering whether or not my observation is correct.  I think why this query didn't work, is because this line of queries 

" | where DeviceName !in ( "DC List") "   should be  "| where DeviceName !in ( "listDC")" . 

 "listDC" was defined in line 3.   Thanks!

Resources