Advanced Hunting Query - Negation

Copper Contributor

I am trying to formulate a query that returns email TLD that are NOT in a specified list.

I have the following query which return those I am interested in:

EmailEvents
| where SenderFromDomain  has_any (".com", ".net", ".org", ".uk")
what is the negation of the above statement where I can list the TLDs I am not interested in seeing?
1 Reply

@markscottwilts 

Try this.

 

EmailEvents
| where not(SenderFromDomain  has_any (".com", ".net", ".org", ".uk"))