Skip to content

Commit c156452

Browse files
committed
Added links to watchlists.md
1 parent 8c8a6d9 commit c156452

File tree

1 file changed

+12
-3
lines changed

1 file changed

+12
-3
lines changed

articles/sentinel/watchlists.md

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,9 @@ Query data in any table against data from a watchlist by treating the watchlist
7474
The following example query joins the `RemoteIPCountry` column in the `Heartbeat` table with the search key defined for the watchlist named `mywatchlist`.
7575

7676
```kusto
77-
Heartbeat
78-
| lookup kind=leftouter _GetWatchlist('mywatchlist')
79-
on $left.RemoteIPCountry == $right.SearchKey
77+
Heartbeat
78+
| lookup kind=leftouter _GetWatchlist('mywatchlist')
79+
on $left.RemoteIPCountry == $right.SearchKey
8080
```
8181

8282
Let's look some other example queries.
@@ -115,6 +115,15 @@ The following example query uses the watchlist inline with the query and the sea
115115

116116
For more information, see [Build queries and detection rules with watchlists in Microsoft Sentinel](watchlists-queries.md).
117117

118+
See more information on the following items used in the preceding examples, in the Kusto documentation:
119+
- [***where*** operator](/kusto/query/where-operator?view=microsoft-sentinel&preserve-view=true)
120+
- [***project*** operator](/kusto/query/project-operator?view=microsoft-sentinel&preserve-view=true)
121+
- [***lookup*** operator](/kusto/query/lookup-operator?view=microsoft-sentinel&preserve-view=true)
122+
- [***in*** operator](/kusto/query/in-cs-operator?view=microsoft-sentinel&preserve-view=true)
123+
- [***let*** statement](/kusto/query/let-statement?view=microsoft-sentinel&preserve-view=true)
124+
125+
[!INCLUDE [kusto-reference-general-no-alert](includes/kusto-reference-general-no-alert.md)]
126+
118127
## Next steps
119128

120129
To learn more about Microsoft Sentinel, see the following articles:

0 commit comments

Comments
 (0)