KQL Search

This query is designed to analyze network events related to potentially malicious website redirects over the past 90 days. Here's a simple breakdown of what it does:

1. Load Data: It starts by loading a list of potentially harmful website redirectors from an external CSV file hosted on GitHub. This list is stored in a table called WebsiteRedirectors.

2. Extract Domain List: From this table, it extracts the IndicatorValue column, which contains the domain names of these redirectors, and stores them in a list called DomainList.

3. Filter Network Events: The query then looks at network events from the last 90 days (DeviceNetworkEvents) and filters them to find events where the RemoteUrl (the URL accessed by a device) matches any domain in the DomainList.

4. Create VirusTotal Links: For each matching event, it creates a link to VirusTotal, a website that provides information about the safety of domains. This link is stored in a new column called VT_domain.

5. Summarize Results: Finally, it summarizes the data by counting how many times each RemoteUrl appears in the filtered events, along with its corresponding VirusTotal link.

In essence, this query helps identify and count the number of times devices in the network have accessed potentially harmful websites, providing a quick way to investigate these domains further using VirusTotal.