A demonstration of how to use Kusto Query Language in your first Microsoft Sentinel analytics rule.
MustLearnKQL Table of Contents: https://aka.ms/MustLearnKQL
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 20: Building your …

A demonstration of the Kusto Query Language Union and Join Operators.
MustLearnKQL Table of Contents: https://aka.ms/MustLearnKQL
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 19: The Join Operator …

A demonstration of the Kusto Query Language Let statement.
MustLearnKQL Table of Contents: https://aka.ms/MustLearnKQL
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 17: The Let Statement …

A demonstration of the Kusto Query Language Order / Sort and Top operators.
MustLearnKQL Table of Contents: https://aka.ms/MustLearnKQL
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 16: The Order/Sort and Top Operators …

A demonstration of the Kusto Query Language distinct operator.
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 15: The Distinct Operator
  https://azurecloudai.blog/2022/01/24/must-learn-kql-part-15-the-distinct-operator/

• Must …

A demonstration of the Kusto Query Language project operator.
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

Cliffnotes

• Used to cut out all the rif raf and view only the pieces of data that are meaningful to you
• Project-Away: Display all columns except …

A demonstration of how to use the KQL Extend operator and integrate it into your workflow.
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

Cliffnotes

• Used to create custom views of data to better inform risk
  • Allows you to create custom columns in real-time …

A video demonstration of the Kusto Query Language render operator.
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 20: Your first analytics rule …

A video demonstration of the Kusto Query Language summarize operator.
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 20: Your first analytics rule …

A video demonstration of the Kusto Query Language count operator.

MustLearnKQL Table of Contents: https://aka.ms/MustLearnKQL
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 20: Your first analytics rule …