Advanced Hunting Query - Negation

Copper Contributor

I am trying to formulate a query that returns email TLD that are NOT in a specified list.

I have the following query which return those I am interested in:

| where SenderFromDomain  has_any (".com", ".net", ".org", ".uk")
what is the negation of the above statement where I can list the TLDs I am not interested in seeing?
1 Reply


Try this.


| where not(SenderFromDomain  has_any (".com", ".net", ".org", ".uk"))