Hands On: Kusto Query Language(KQL)

Use the KQL search operator to query across log workspace tables or a specific table, with case-insensitive defaults and case_sensitive for exact matches; supports starts with, ends with, and wildcards.

Master how to use the where clause and where operator in KQL to filter data by time ranges, combine criteria, and perform searches with contains, starts with, and ends with.

Explore kql operators such as take, limit, count, summarize, bin, extend, project, and distinct with perf record examples, deriving columns and grouping by time for per-computer metrics.

Learn to sort KQL results with order by and handle time with now and ago, while extracting and projecting data to derive new fields, and practice ascending and descending sorts.

Demonstrates kusto query language operators iif, strcat, and case to implement conditional logic, handle is empty and is null values, and perform string conversion and splitting in last 20 minutes.

Explore Kusto query language operators arg_max, arg_min, makelist, makeset, mv-expand, and counting functions, using summarize to compute maxima, minima, distinct counts, and array expansion.

Master Kusto query language constructs, including let variables, join and union operations, and data table creation. Explore range generation and date ranges with practical examples on performance and security events.

Apply your KQL knowledge hands-on by working through detective inbox exercises, validating prerequisites and scripts in the ADX explorer, and focusing on solutions while building understanding of schema.

Join a gamified Kusto query language detective challenge, create a free cluster, use the query editor in the ADX interface, and sum the score column to verify results.

Identify the missing rare book by querying books and shelves data in KQL, expanding RFID arrays, joining tables, and calculating shelf weight and counts.

Explore a free BlueRaven KQL security analysis course with lab access on Azure Data Explorer, featuring quizzes, 128 lessons, and a certificate to boost security analyst skills.

Lead a lab introduction to kql for security analysis, exploring kusto query language fundamentals, data exploration, searching and filtering, joins, aggregation, and anomaly detection in ADX.

Provision lab access to Azure Data Explorer (ADX) and KQL in 30 minutes after email invitation. Sign in and activate MFA for stable lab use.

Master KQL fundamentals and data exploration by learning pipes, tabular expressions, and data types. Apply hands-on techniques with sample, take, limit, distinct, and project operations, including obfuscated strings.

Master searching and filtering data in kql with search and where operators, scalar operators like has and contains, and regex, plus indexing basics and let statements for efficient security analysis.

Explore Kusto query language joins and unions to merge user login events and user profiles. Use inner joins, fuzzy handling, and source tracking to detect anomalies.

Explore data aggregation in KQL using the summarize operator, aggregation functions, and optional grouping to transform large data into meaningful insights. Apply anomaly detection with static thresholds and whitelisting.