Sentinel Query error

%3CLINGO-SUB%20id%3D%22lingo-sub-3426297%22%20slang%3D%22en-US%22%3ESentinel%20Query%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3426297%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20anyone%20know%20how%20to%20assign%20variable%20with%20network%3Astring%20if%20we%20are%20using%20watchlist%20with%20CIDR.%26nbsp%3B%20I%20am%20getting%20below%20error.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20subnets%20%3D%20(_GetWatchlist('TorrentList')%7Cproject%20SearchKey)%3B%3C%2FP%3E%3CP%3E%7C%20evaluate%20ipv4_lookup(subnets%2C%20IPAddress%2C%20network%2C%20return_unmatched%20%3D%20true)%3CBR%20%2F%3E%7C%20where%20isempty(network)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EError%3A%3C%2FP%3E%3CP%3E%3CSPAN%3E'evaluate'%20operator%3A%20Failed%20to%20resolve%20column%20or%20scalar%20expression%20named%20'network'%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThanks%20a%20ton!!%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

Hello,

 

Does anyone know how to assign variable with network:string if we are using watchlist with CIDR.  I am getting below error. 

 

let subnets = (_GetWatchlist('TorrentList')|project SearchKey);

| evaluate ipv4_lookup(subnets, IPAddress, network, return_unmatched = true)
| where isempty(network)

 

Error:

'evaluate' operator: Failed to resolve column or scalar expression named 'network'

 

Thanks a ton!!

1 Reply
There are examples in the Github:
https://github.com/Azure/Azure-Sentinel/search?l=YAML&q=ipv4_lookup

You need a table and the network data has to be in that Table or the watchlist - this rough example fakes the network info but relies and adds a Table (this is made up, but shows you how I hope)

let network='1.1.1.1/32';
let subnets = (_GetWatchlist('ipa')|project SearchKey);
AzureActivity
| evaluate ipv4_lookup(subnets, CallerIpAddress, network, return_unmatched = true)
| where isempty(network)