CODEWITHSUNDEEP
kqlazure-sentinel
Shabarinath
Shabarinath

Reputation: 144

KQL Query for creating domain list from UserPrincipalName

is there a way for building a list of unique user domains in a delimited format from sentinel signin logs? Signin logs has user principal name and can be extended to split the domain name as below.

extend UserDomains = split(UserPrincipalName,'@')[1]

Upvotes: 0

Views: 1237

Answers (1)

Avnera
Avnera

Reputation: 7618

You can use the make_set() aggregation function, for example:

T
| extend UserDomains = split(UserPrincipalName,'@')[1] 
| summarize UserDomains = make_set(UserDomains)

Upvotes: 1

Related Questions