CODEWITHSUNDEEP
kqlazure-log-analyticsazure-sentinel
ChristofferL
ChristofferL

Reputation: 119

Match partial string from list with field

I'm trying to check if a field contains a value from a list using Kusto in Log analytics/Sentinel in Azure.

The list contains top level domains but I only want matches for subdomains of these top levels domains. The list value example.com should match values such as forum.example.com or api.example.com.

I got the following code but it does exact matches only.

let domains = dynamic(["example.com", "amazon.com", "microsoft.com", "google.com"]);
DeviceNetworkEvents
| where RemoteUrl in~ (domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountUpn, RemoteUrl

I tried with endswith, but couldn't get that to work with the list.

Upvotes: 0

Views: 6294

Answers (2)

Slavik N
Slavik N

Reputation: 5298

In order to correctly match URLs with a list of domains, you need to build a regex from these domains, and then use the matches regex operator.

Make sure you build the regex correctly, in order not to allow these:

  • example.com.hacker.com
  • hackerexample.com
  • hacker.com/example.com
  • Etc...

Upvotes: 1

Avnera
Avnera

Reputation: 7608

It seems that has_any() would work for you:

let domains = dynamic(["example.com", "amazon.com", "microsoft.com", "google.com"]);
DeviceNetworkEvents
| where RemoteUrl has_any(domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountUpn, RemoteUrl

Note that you can also use the has_any_index() to get which item in the array was matched

Upvotes: 6

Related Questions