KQL Search

# Function: ListDomainControllers()

## Query Information

#### Description
This function list all the domain controllers in your environment. Which might be usefull if you are not aware of the syntax to identify them, alternatively this function can also be used to build detections specifically for or filter on domain controllers.

#### References
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/functions/user-defined-functions
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-custom-functions?view=o365-worldwide

## Defender For Endpoint
```
// This function list all domain controllers that have been active in the last 7 days. 
let ListDomainControllers =
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where LocalPort == 88
    | where LocalIPType == "FourToSixMapping"
    | distinct DeviceName;
// Example    
ListDomainControllers
```
## Sentinel
```
// This function list all domain controllers that have been active in the last 7 days. 
let ListDomainControllers =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where LocalPort == 88
    | where LocalIPType == "FourToSixMapping"
    | distinct DeviceName;
// Example    
ListDomainControllers
```