Forum Discussion

akshay25june's avatar
akshay25june
Copper Contributor
Aug 22, 2024

watchlist with contains

Hi Team,

 

can someone help me. I have a list of dynamic Dns domain and performing KQL with _Im_Dns table.

I have created watchlist of domain and apply to _Im_Dns table. So i am getting the result if exact match in DnsQuery column. Like in my watchlist if microsoft.com is dynamic domain then it getting result only when DnsQuery column has microsoft.com. But my concern is that i want to get result if DnsQuery column has xyz.microsoft.com.Abc.

 

let DynamicDns = _GetWatchlist('dynamic_dns') | project  SearchKey;

_Im_Dns

| where DnsQuery in~ (DynamicDns)

 

My watchlist have 30k+ dynamic DNS. Kindly suggest us.

KQL
Kusto
  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Aug 22, 2024

    akshay25june 

     

    Maybe something based on this?

     

    let DynamicDns = _GetWatchlist('dynamic_dns') | distinct SearchKey, index=1;
let myDNS = _Im_Dns | distinct DnsQuery, index=1;
DynamicDns
| join kind=inner (myDNS) on index_
| where DnsQuery contains SearchKey

Resources