KQL Search

This KQL (Kusto Query Language) query is designed to analyze network events related to website redirects. Here's a simplified breakdown of what the query does:

1. Data Import: It starts by importing a list of website redirectors from an external CSV file hosted on GitHub. This file contains two columns: type and IndicatorValue, but only the IndicatorValue (which represents domain names) is used.

2. Domain List Extraction: The query extracts the IndicatorValue column from the imported data to create a list of domains (DomainList).

3. Event Filtering: It then examines network events (DeviceNetworkEvents) from the last 90 days.

4. Domain Matching: The query filters these events to find instances where the RemoteUrl (the URL accessed during the network event) matches any domain in the DomainList.

5. VirusTotal URL Creation: For each matching event, it creates a URL that links to the VirusTotal page for that domain. This is done using the extend operator to add a new column (VT_domain) that contains the VirusTotal URL.

6. Event Summarization: Finally, the query summarizes the data by counting the number of events for each RemoteUrl and its corresponding VirusTotal URL.

In essence, this query identifies and counts network events involving specific website redirects from a predefined list, and provides links to their VirusTotal analysis pages.