Forum Discussion
Solved
Watchlist and query
new to kql here, is it possible to build a query that search's across logs looking for machines that connected to any of ip addresses in the watchlist? Any examples ? Plan would be to turn that que...
roadruner This is the starting query for something like that.
let ClearedIPAddresses=_GetWatchlist('test1');
CommonSecurityLog
| join ClearedIPAddresses on $left.SourceIP== $right.IPAddress
roadruner Here is a simple example of how to do this. I created a CSV file that has all the IPAddresses I have cleared and uploaded that into the Watchlist using "ClearedIPAddreses" as the alias.
let ClearedIPAddresses=_GetWatchlist('ClearedIPAddresses');
Heartbeat
| join ClearedIPAddresses on $left.ComputerIP == $right.IPAddress
