Match partial string from list with field

Question

I'm trying to check if a field contains a value from a list using Kusto in Log analytics/Sentinel in Azure.

The list contains top level domains but I only want matches for subdomains of these top levels domains. The list value example.com should match values such as forum.example.com or api.example.com.

I got the following code but it does exact matches only.

let domains = dynamic(["example.com", "amazon.com", "microsoft.com", "google.com"]);
DeviceNetworkEvents
| where RemoteUrl in~ (domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountUpn, RemoteUrl

I tried with endswith, but couldn't get that to work with the list.

Answer 1

In order to correctly match URLs with a list of domains, you need to build a regex from these domains, and then use the matches regex operator.

Make sure you build the regex correctly, in order not to allow these:

• example.com.hacker.com
• hackerexample.com
• hacker.com/example.com
• Etc...