KQL Search

This KQL (Kusto Query Language) query is designed to analyze network events related to gaming domains over the past 90 days. Here's a simplified breakdown of what it does:

1. Load Gaming Domains: It retrieves a list of gaming-related domain names from an external CSV file hosted on GitHub. The CSV file is read with the first record ignored (likely because it contains headers).

2. Extract Domain List: It extracts the domain names from the loaded data into a list called DomainList.

3. Filter Network Events: It looks at network events from the DeviceNetworkEvents table that have occurred in the last 90 days.

4. Match with Gaming Domains: It filters these events to only include those where the RemoteUrl (the URL accessed by a device) matches any domain in the DomainList.

5. Create VirusTotal Links: For each matching event, it creates a link to the VirusTotal website for the domain, which can be used to check the domain's reputation or any associated security information.

6. Summarize Results: Finally, it summarizes the data by counting the number of events for each domain and includes the VirusTotal link for reference.

In essence, this query helps identify how often devices in the network have accessed gaming-related domains recently and provides a way to further investigate these domains using VirusTotal.