How do I exclude a watchlist from a query?

Copper Contributor




// The query_now parameter represents the time (in UTC) at which the scheduled analytics rule ran to produce this alert.
set query_now = datetime(2022-10-12T14:13:18.6528231Z);
| where InitiatingProcessFileName in~("cmd.exe", "explorer.exe", "powershell.exe")
| where ProcessCommandLine has_any ("arp", "whoami", "netstat", "nslookup")
| sort by TimeGenerated desc




If I want to exlude some accounts in a watchlist, how to edit KQL

1 Reply
There is an example at the end of this thread on a watchlist and the syntax you need