如何在第二个查询中使用第一个 KQL 查询的结果来过滤结果？

Question

我有一个返回域名列表的第一个 KQL 查询，然后我想使用这些查询来过滤另一个 KQL 查询。 我只是想不出这样做的语法。 有没有办法在 KQL 中将 contains() 运算符与 for 循环/迭代一起使用？

KQL - 查询 1

    let hostnames = () {
    AllDomains 
    | where hostname !contains "default.com" and hostname != ""
    | distinct hostname
   }

KQL - 查询 2

let start_date = ago(10m);
let end_date = now();
LogEvents 
| where env_time between (start_date .. end_date)
| where headers  contains "X-Forwarded-For"
| where queryString contains (hostnames()) //This is what is needed to filter on all the domains from first query.
| project queryString 

Answer 1

如果您能提供一个样本，说明您的数据看起来如何以及您想要完成什么，那会更好，但我认为您想要使用has_any而不是contains

Answer 2

这可以工作：

let hostnames =
    AllDomains 
    | where isnotempty(hostname) and hostname !has "default.com"
    | distinct hostname
;
let start_date = ago(10m);
let end_date = now();
LogEvents 
| where env_time between (start_date .. end_date)
| where headers contains "X-Forwarded-For"
| where queryString has_any (hostnames)
| project queryString