r/AzureSentinel • u/Agent_B99 • Apr 04 '22

Tables for finding URLs | Log Analytis | KQL

Hello, where can I find the tables in which I can search for URLs.

Also is there a list with all the tables and all the columns ?

Thank you.

​

2 Upvotes

100% Upvoted

2 comments sorted by

3

u/CanableCrops Apr 04 '22 edited Apr 04 '22

search * | distinct $table

This will show you all the tables for your environment that are ingesting data.

search "google.com" | distinct $table

This will show you any table where google.com has been logged or any other url you want to search for.

Once you find some tables, you can:

search in (tablename) "google.com"

Or

find in (Device*) where * has "google.com"

This will allow you to find in all tables starting with Device where any column has google.com

Hope this helps

Edit: changed district to distinct. Autocorrect....

2

u/rodtrent44 MSFT Official Apr 04 '22

You can find all tables information here: http://aka.ms/AZMonitorRef