MustLearnKQL - The Workflow

This is a basic example of how to use @RodTrent's KQL workflow to go from blank canvas to actionable query.

MustLearnKQL Github repo https://aka.ms/MustLearnKQL - Everything Rod produces can be found here.
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

• Must Learn KQL Part 20: Your first analytics rule
  https://azurecloudai.blog/2022/02/17/must-learn-kql-part-20-building-your-first-microsoft-sentinel-analytics-rule/

• Must Learn KQL Part 19: The Join Operator
  https://azurecloudai.blog/2022/02/14/must-learn-kql-part-19-the-join-operator/

• Must Learn KQL Part 18: The Union Operator
  https://azurecloudai.blog/2022/02/07/must-learn-kql-part-18-the-union-operator/

• Must Learn KQL Part 17: The Let Statement
  https://azurecloudai.blog/2022/02/01/must-learn-kql-part-17-the-let-statement/

• Must Learn KQL Part 16: The Order/Sort and Top Operators
  https://azurecloudai.blog/2022/01/26/must-learn-kql-part-16-the-order-sort-and-top-operators/

• Must Learn KQL Part 15: The Distinct Operator
  https://azurecloudai.blog/2022/01/24/must-learn-kql-part-15-the-distinct-operator/

• Must Learn KQL Part 14: The Project Operator
  https://azurecloudai.blog/2022/01/20/must-learn-kql-part-14-the-project-operator/

• Must Learn KQL Part 13: The Extend Operator
  https://azurecloudai.blog/2022/01/18/must-learn-kql-part-13-the-extend-operator/

• Must Learn KQL Part 12: The Render Operator (with Bin and Time)
  https://azurecloudai.blog/2022/01/10/must-learn-kql-part-12-the-render-operator/

• Must Learn KQL Part 11: The Summarize Operator
  https://azurecloudai.blog/2022/01/05/must-learn-kql-part-11-the-summarize-operator/

• Must Learn KQL Part 10: The Count Operator
  https://azurecloudai.blog/2021/12/14/must-learn-kql-part-10-the-count-operator/

• Must Learn KQL Part 9: The Limit/Take Operators
  https://azurecloudai.blog/2021/12/13/must-learn-kql-part-9-the-limit-and-take-operators/

• Must Learn KQL Part 8: The Where Operator
  https://azurecloudai.blog/2021/12/08/must-learn-kql-part-8-the-where-operator/

• Must Learn KQL Part 7: Schema Talk
  https://azurecloudai.blog/2021/12/07/must-learn-kql-part-7-schema-talk/

• Must Learn KQL Part 6: Interface Intimacy
  https://azurecloudai.blog/2021/12/02/must-learn-kql-part-6-interface-intimacy/

• Must Learn KQL Part 5: Turn Search into Workflow Posted November 29, 2021
  https://azurecloudai.blog/2021/11/29/must-learn-kql-part-5-turn-search-into-workflow/

• Must Learn KQL Part 4: Search for Fun and Profit Posted November 22, 2021
  https://azurecloudai.blog/2021/11/22/must-learn-kql-part-4-search-for-fun-and-profit/

• Must Learn KQL Part 3: Workflow
  https://azurecloudai.blog/2021/11/19/must-learn-kql-part-3-workflow/

• Must Learn KQL Part 2: Just Above Sea Level
  https://azurecloudai.blog/2021/11/18/must-learn-kql-part-2-just-above-sea-level/

• Must Learn KQL Part 1: Tools and Resources
  https://azurecloudai.blog/2021/11/17/must-learn-kql-part-1-tools-and-resources/

Website: www.cyberautomate.io
Twitter: @cyberautomate
https://github.com/cyberautomate