Forum Discussion
KQL to extract URL from TI Feeds
Hello, I need some help to extract a specific field (URL) from URL Haus Database. Example "3430907","2025-02-07 11:02:07","http://chmod0777kk.com/main","online","2025-02-07 11:02:07","malware_down...
Hi HA13029!
You can use the following KQL query to extract the URL from the given feed:
| where Column3 contains "http" | project URL = Column3This assumes the URL is in the third column of the dataset, so adjust it based on your specific data structure. It will filter the entries containing "http" and show the URL in the result.
