Construct KQL statements for Microsoft Sentinel

Intermediate
Security Operations Analyst
Azure
Azure Data Explorer
Azure Log Analytics
Microsoft Sentinel

KQL is the query language used to perform analysis on data to create analytics, workbooks, and perform hunting in Microsoft Sentinel. Learn how basic KQL statement structure provides the foundation to build more complex statements.

Learning objectives

Upon completion of this module, the learner will be able to:

  • Construct KQL statements
  • Search log files for security events using KQL
  • Filter searches based on event time, severity, domain, and other relevant data using KQL

Prerequisites

none