How can I get this cosmos db attribute

Question

I need to get to create a "select *" based on "destinationUrl" attribute, but when I try:

select *
from c
where c.networkConnections.destinationUrl != null

it doesn't work. What is the correct syntax for this?

{
    "id": "5ec2605d-ef57-471c-afd8-ea217b12c0xxx",
    "confidence": null,
    "createdDateTime": "2021-05-22T03:41:52.9Z",
    "status": "inProgress",
    "title": "asd",
    "vendorInformation": {
        "provider": "asd",
        "providerVersion": null,
        "subProvider": null,
        "vendor": "asd"
    },
    "alertDetections": [],
    "cloudAppStates": [],
    "fileStates": [],
    "hostStates": [],
    "historyStates": [],
    "investigationSecurityStates": [],
    "messageSecurityStates": [],
    "networkConnections": [
        {
            "applicationName": null,
            "destinationAddress": null,
            "destinationDomain": null,
            "destinationLocation": null,
            "destinationPort": null,
            "destinationUrl": "waitingroom.snow.com"

        }
    ],
    "processes": [],
    "registryKeyStates": [],
    "securityResources": [],
    "triggers": []
}

Answer 1

SELECT c.id FROM c join t in c.networkConnections where t.destinationUrl != null

Because destinationUrl is type array, so we need to use join to work as a subquery. And we also need to check if array destinationUrl always has item in it or has multiple items in it.

I mean if we need to take these situations into consideration? If it's no need, then my query above is enough.

"networkConnections": [],

"networkConnections": [
        {
            "applicationName": null,
            "destinationAddress": null,
            "destinationDomain": null,
            "destinationLocation": null,
            "destinationPort": null,
            "destinationUrl": null
        },
        {
            "applicationName": null,
            "destinationAddress": null,
            "destinationDomain": null,
            "destinationLocation": null,
            "destinationPort": null,
            "destinationUrl": "asdfasdf"
        }
    ]