help in kql query

[eladfe]

hay

I have a list of IP's and i want to check each one of them exist in the dns of the network adapter .

So for one address this is fine:

DeviceNetworkInfo

| where DnsAddresses  contains "192.168.1.1"

but what to do if i have a list of IP's and i want to check each one of them? 

Thanks

[#2]

@eladfe 

A couple options...

1. Use the KQL let statement
2. Use the externaldata operator (https://rodtrent.com/d9f) 
3. Use a Watchlist

Both let statement and Watchlist covered here: https://rodtrent.com/fsb 

[#3]

Hi @eladfe,
Additionally, we have a nice list of Advanced Hunting (AH) samples here: https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries and Azure Sentinel, has Advanced Hunting query samples here: https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries
Thanks,
Yong Rhee - MSFT