Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community
SOLVED

Compare a watchlist of IPs to DNS Events

Microsoft

I am trying to compare IOCs from a watchlist in Sentinel to the DnsEvent based on a KQL query. But I am having trouble comparing the two sources. I thought about a union statement, but I can't get around that I have to compare specific columns in two different sources. Does anyone know how to compare results (ips) from a watchlist to DNS events using KQL? 

1 Reply
best response confirmed by agoodson (Microsoft)
Solution

@agoodson a join would work. 

 

_GetWatchlist('IPAddresses')
| join (DnsEvents) on $left.IPAddress == $right.IPAddresses
1 best response

Accepted Solutions
best response confirmed by agoodson (Microsoft)
Solution

@agoodson a join would work. 

 

_GetWatchlist('IPAddresses')
| join (DnsEvents) on $left.IPAddress == $right.IPAddresses

View solution in original post