Filtering using watchlist on multiple fields

New Contributor

Hello,

 

I am new to KQL. I am trying to use watchlists to filter out some false positives from a rule in sentinel. I can do the filtering based on one field from watchlist, but what if I need combination of both?

 

When filtering based on one condition:

DeviceLogonEvents
| where AccountName !in~ ((_GetWatchlist('npa_test') | project AccountName))

 

What if I want to use combination of DeviceName and AccountName from the watchlist? Any help much appreciated!

2 Replies

@staro69 Can you combine the fields in your watchlist (as maybe a third field) and then combine the fields you need in the DeviceLogonEvents table using the extend command and then compare the new field to the 3rd field from your watchlist?

 

Thanks, that can actually work!