Match partial string from list with field

Question

I'm trying to check if a field contains a value from a list using Kusto in Log analytics/Sentinel in Azure.

The list contains top level domains but I only want matches for subdomains of these top levels domains. The list value example.com should match values such as forum.example.com or api.example.com.

I got the following code but it does exact matches only.

let domains = dynamic(["example.com", "amazon.com", "microsoft.com", "google.com"]);
DeviceNetworkEvents
| where RemoteUrl in~ (domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountUpn, RemoteUrl

I tried with endswith, but couldn't get that to work with the list.

Answer 1

It seems that has_any() would work for you:

let domains = dynamic(["example.com", "amazon.com", "microsoft.com", "google.com"]);
DeviceNetworkEvents
| where RemoteUrl has_any(domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountUpn, RemoteUrl

Note that you can also use the has_any_index() to get which item in the array was matched