Forum Discussion

sulaimanncs915's avatar
sulaimanncs915
Copper Contributor
Sep 26, 2023

error query threat hunting

// Query2
// Summary of e-mail SEND to free web mail services
let timeframe = 1d;
// popular public web service domains
let emailservicedomains =dynamic (["gmail.com","outlook.com","hotmail.com","gmx.de",
"yahoo.com","mail.com","web.de","mail.ru","freenet.de","ziggo.nl","xs4all.nl",
"seznam.cz","email.cz","aol.com","hotmail.co.uk","hotmail.fr",
"msn.com","yahoo.fr","orange.fr","wanadoo.fr","comcast.net",
"yahoo.com.br","yahoo.co.in","live.com","rediffmail.com","free.fr","yandex.ru","ymail.com","libero.it",
"uol.com.br","bol.com.br","cox.net","hotmail.it","sbcglobal.net","sfr.fr","live.fr","verizon.net","live.co.uk","googlemail.com","yahoo.es",
"ig.com.br","live.nl","bigpond.com","terra.com.br","yahoo.it","neuf.fr","yahoo.de","alice.it","rocketmail.com","att.net","laposte.net",
"facebook.com","bellsouth.net","yahoo.in","hotmail.es","charter.net","yahoo.ca","yahoo.com.au","rambler.ru","hotmail.de","tiscali.it",
"shaw.ca","yahoo.co.jp","sky.com","earthlink.net","optonline.net","freenet.de","t-online.de","aliceadsl.fr",
"virgilio.it","home.nl","qq.com","telenet.be","me.com","yahoo.com.ar","tiscali.co.uk","yahoo.com.mx","voila.fr","gmx.net",
"mail.com","planet.nl","tin.it","live.it","ntlworld.com","arcor.de","yahoo.co.id","frontiernet.net","hetnet.nl","live.com.au",
"yahoo.com.sg","zonnet.nl","club-internet.fr","juno.com","optusnet.com.au","blueyonder.co.uk","bluewin.ch","highspeed.ch",
"skynet.be","sympatico.ca","windstream.net","mac.com","centurytel.net","chello.nl","live.ca","aim.com","bigpond.net.au"
"yahoo.co.uk"]);
EmailEvents
| where Timestamp > ago (timeframe)
| extend ReceipientDomain = tostring(split(RecipientEmailAddress,"@",1)[0])
| where ReceipientDomain in (emailservicedomains)
| summarize count() by ReceipientDomain
 
 
hi,
 
please help
 

 

An error has occurred

 

Error messageAn unexpected error occurred during query execution. Please try again in a few minutes.
SIEM
Threat Hunting
  • LeonPavesic's avatar
    LeonPavesic
    Silver Contributor
    Sep 26, 2023

    Hi sulaimanncs915,

    The error message "An unexpected error occurred during query execution. Please try again in a few minutes." is a generic error message that can occur for a variety of reasons.

    In the case of your query, it is possible that the error is caused by the following:

    • A temporary issue with the Kusto service. This could be due to a high volume of traffic or a maintenance event.
    • A syntax error in the query. This could be a typo, a missing comma, or an incorrect operator.
    • A permission issue. You may not have the necessary permissions to run the query.
    • A bug in the Kusto service. If you have tried running the query multiple times and it continues to fail, it is possible that there is a bug in the Kusto service.


    Please click Mark as Best Response & Like if my post helped you to solve your issue.
    This will help others to find the correct solution easily. It also closes the item.


    If the post was useful in other ways, please consider giving it Like.


    Kindest regards,


    Leon Pavesic
    (LinkedIn)

Share

Resources