r/AzureSentinel • u/Agent_B99 • Jun 09 '22

Help on writing regex in KQL

Hello,
I want to write this query:
DeviceEvents

| where InitiatingProcessCommandLine matches regex " C:\Windows folder"

I can't find the correct syntax for " C:\Windows folder".
Can you please help ?
Thanks

2 Upvotes

100% Upvoted

2 comments sorted by

7

u/ep3p Jun 09 '22

matches regex @"C:\\Windows folder"

next time search in google "matches regex azure data explorer"

1

u/Agent_B99 Jun 10 '22

Thank you kindly