KQL如何根据列表查找table中的行

Question

下面的代码报错：发生识别错误

let vips = datatable (name: string)
['xxxx',
 'yyyy',
 'zzzz',
 'gggg'];
DeviceLogonEvents  
| where AccountName  in~ (vips)
| summarize by DeviceName
| summarize vippc = make_list(DeviceName)
DeviceAlertEvents
| where DeviceName in (vippc)

关于如何在 DeviceName 列的 DeviceAlertEvents 列表 vippc 中搜索项目的任何建议？

Answer 1

你可以试试这个：

let vips = datatable(name: string)
[
 'xxxx',
 'yyyy',
 'zzzz',
 'gggg'
]
;
let vippc = 
   DeviceLogonEvents  
   | where AccountName  in~ (vips)
   | distinct DeviceName
;
DeviceAlertEvents
| where DeviceName in (vippc)

KQL如何根据列表查找table中的行

KQL How to find rows in table based on list

kql

windows-defender