SC-200 part 4: Create queries for Azure Sentinel using Kusto Query Language (KQL)

Intermediate
Security Operations Analyst
Azure
Sentinel

Write Kusto Query Language (KQL) statements to query log data to perform detections, analysis, and reporting in Azure Sentinel. This learning path will focus on the most used operators. The example KQL statements will showcase security related table queries.

Prerequisites

Basic understanding of scripting concepts.

Modules in this learning path

KQL is the query language used to perform analysis on data to create analytics, workbooks, and perform hunting in Azure Sentinel. Learn how basic KQL statement structure provides the foundation to build more complex statements.

Learn how to summarize and visualize data with a KQL statement provides the foundation to build detections in Azure Sentinel.

Learn how to work with multiple tables using KQL.

Learn how to use the Kusto Query Language (KQL) to manipulate string data ingested from log sources.