help in kql query

New Contributor

hay

I have a list of IP's and i want to check each one of them exist in the dns of the network adapter .

So for one address this is fine:

DeviceNetworkInfo
| where DnsAddresses  contains "192.168.1.1"
but what to do if i have a list of IP's and i want to check each one of them? 
Thanks

 

2 Replies

@eladfe 

 

A couple options...

 

  1. Use the KQL let statement
  2. Use the externaldata operator (https://rodtrent.com/d9f
  3. Use a Watchlist

Both let statement and Watchlist covered here: https://rodtrent.com/fsb 

Hi @eladfe,
Additionally, we have a nice list of Advanced Hunting (AH) samples here: https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries and Azure Sentinel, has Advanced Hunting query samples here: https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries
Thanks,
Yong Rhee - MSFT