Sentinel Saturdays: Use External Data Sources in Your Threat Hunts

Sometimes the data you need to hunt threats isn’t inside Sentinel. Maybe it’s a CSV on GitHub containing known malicious IPs or a public feed of compromised domains. The good news is that you can easily reference this external data directly in your KQL hunts using Sentinel’s externaldata() operator.

Breakdown

Let’s walk through a practical example using a GitHub-hosted CSV:

1. Find a publicly accessible CSV file, for our example, I will use Jay Kerai's repository: https://github.com/jkerai1/SoftwareCertificates/tree/main/Bulk-IOC-CSVs
2. In the Logs view, use the externaldata() operator to load it into your query:

let AiTMDomains = externaldata(type: string, IndicatorValue: string)[@"https://raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/Aitms2.csv"] with (format="csv", ignoreFirstRecord=True);
let DomainList = AiTMDomains
| project IndicatorValue;
DeviceNetworkEvents
| where RemoteUrl in~(DomainList )
| extend VT_domain = iff(isnotempty(RemoteUrl),strcat(@"https://www.virustotal.com/gui/domain/",RemoteUrl),RemoteUrl)

3. This example loads the list into memory and compares it against your local logs. You can adjust the schema to match the CSV headers.
4. For larger datasets or recurring hunts, consider storing the file in an Azure Storage Account or Microsoft 365 blob for faster access and easier version control.

This method gives you flexibility to pivot your hunting beyond internal telemetry, integrating community intel or your own threat feeds seamlessly.

Try pulling an external dataset into your next KQL hunt and see what extra insights you uncover.