azure - KQL 查询根据条件过滤值

Question

需要帮助从哨兵登录日志收集的用户主体名称中过滤用户域。我将所有用户域从 upn 中分离出来，如下所示。

扩展 UserDomains = split(UserPrincipalName,'@')[1]

除了 UserDomains 之外，我还需要内部域和外部域。如何根据特定条件进一步过滤 UserDomains。

干杯!

Answer 1

您可以使用类似 iif 的运算符:

T 
| extend IsInternalDomain = iif(UserDomains contains "mycompany.com", true, false)
| where IsInternalDomain

或

T 
| extend DomainType = iif(UserDomains contains "mycompany.com", "Internal", "External")
| where DomainType == "Internal"

或者case运算符:

T 
| extend DomainType = case(UserDomains contains "us.mycompany.com", "Internal US", 
                           UserDomains contains "mycompany.com", "Internal",
                           "External")
| where DomainType == "Internal US"

或者您可以简单地使用 where ，如下所示:

T 
| where UserDomains !endswith "mycompany.com" // include only external domains