Kusto Query Language (KQL) for Cybersecurity

We explore how complexity across people, cloud, endpoints, hyperscalers, and IoT makes cyber security harder, with talent shortages, advanced threats, automation gaps, and data overload.

Discover how a security operations center conducts threat intelligence, threat hunting, log management, and threat detection to detect, analyze, and mitigate threats, while reducing the attack surface.

Explore the three-tier security operations center model, from automation handling commodity malware to tier one and tier two investigations, with tier three performing proactive threat hunting and advanced forensics.

Apply the NIST incident handling guide to prepare, detect and analyze, contain and eradicate, and recover from incidents, then perform post-incident activities to capture lessons learned.

Learn how EDR and XDR enable behavior-based threat detection across endpoints and the Microsoft ecosystem, using SIEM, SOAR, and Logic Apps for automated responses.

Explore how blue and red teams protect enterprises, covering security monitoring, incident response, vulnerability tests, and social engineering. Discover purple teaming, merging defenses through collaboration to boost security.

Discover the five cloud computing properties—on-demand self-service, network access, resource pooling, rapid elasticity, and measured service—and see how they enable fast provisioning, scalable resources, and usage-based billing.

Define public, private, hybrid, and multi-cloud environments, highlighting Azure, AWS, and GCP as public clouds, with Azure Stack, AWS Outposts, and Google Anthos for private clouds.

Explore the azure global backbone linking data centers with fiber and subsea cables. See 60 regions, 172 network edge sites, and over 20,000 peering connections delivering performance and resilience.

Explores the shared responsibility model across Azure, AWS, and GCP from on premises to IaaS, PaaS, and SaaS, detailing who manages security, networking, and identities.

Explore the Azure resource hierarchy from management groups and subscriptions to resource groups, detailing how grouping by lifecycle, location, or department supports governance and security.

Explore Azure subscription types including free, student, pay as you go, and enterprise agreement. The course focuses on free and student options for demos.

Explore how Entra ID tenants serve as the identity provider for users and how those identities access Azure subscriptions and resource groups, clarifying the misconception that subscriptions are tenants.

Zero trust is a security strategy and mindset, not a product, that verifies explicitly using all data points to authenticate and authorize actions, and assume breach to minimize blast radius.

Explore Microsoft security cosmos, focusing on cloud security, SOC, and CTI, through Defender XDR, Defender for Identity, Defender for Endpoint, Defender for Cloud Apps, Microsoft Sentinel, and Copilot for security.

Defend across the cyber kill chain by integrating Defender for Office, Defender for Endpoint, Defender for Identity Plus, Defender for Cloud Apps, XDR, and Copilot for security.

Learn KQL, a query language optimized for analyzing large data sets in Azure Log Analytics, Sentinel, and Defender XDR, with flow-based filtering, summarizing, joining, and time series analysis.

Explore the KQL playground for interactive demos in Log Analytics, where you query security event data, inspect table schemas, and run queries with Shift+Enter.

This lecture introduces the search operator in KQL and uses the security event table. It notes that search is slow and often not best practice, with better filtering methods.

Master the where operator in KQL to filter security events by event ID, computer, account type, and process, and combine conditions with and/or, noting case sensitivity.

Use the datetime operator and time spans in kql to query security events, filtering by the last 24 hours or seven days, with time generated and date time ranges.

Learn KQL aggregation using count, dcount, summarize, and top on security events table. Filter for successful logon events (4624) and derive total logon events, unique users, and top event sources.

Sort security events in KQL with order by or sort by, and use take to fetch the ten most recent events, ordered by time generated in ascending order.

Use the extend and project operators in KQL to add columns and tailor outputs, combining extend and project to show an event age and an event hour from time generated.

Use kql startswith, endswith, and contains to query the security event table, filter ip addresses like 10.1 and 10.2, and detect PowerShell in command lines.

Learn how the let operator defines temporary variables in KQL for cybersecurity, enabling filtered security events and summarized counts by account. Reuse the log on events variable in subsequent queries.

Visualize security data with the render operator in kql, producing time charts, bar charts, and column charts of successful log on events from the security events table.

Use the union operator in KQL to combine process creation events and event 4624 data into one view, selecting computer, event ID, time generated, and count from each dataset.

Correlate process creation events (4688) with successful logon events (4624) on the same computer using an inner join in KQL. Limit the time window to an hour to avoid degradation.

Discover left outer joins in KQL by linking process creation events (4688) with logon events (4624) on the same computer, showing all processes and their matching logon details.

Explain right outer joins in kql by comparing them to left joins, using a query that matches process creation events (4688) with successful logon events (4624) on the same computer.

Perform a full outer join in Kql to merge all process creation events (event id 4688) with all successful logon events on the same computer, including unmatched rows.

learn how to create your free azure subscription, choose between free and pay-as-you-go, provide personal details, then log in at portal.azure.com to start building in azure.

Explore Copilot for security's generative AI capabilities for incident response and threat hunting. It supports intelligence gathering, posture management, and end-to-end guidance at machine speed.

Explore how prompting and responses work with Copilot for security, from submitting a prompt to building context and a plan, executing it with plugins, and delivering a crisp, effective response.

Discover how copilot for security integrates organizational security data, threat intelligence, and copilot-generated data within embedded and standalone experiences, aided by plugins and Azure OpenAI services.

Extend copilot for security with plugins linking Defender XDR, Sentinel, Entra, Intune, Purview, and other Microsoft products to connect with third-party services.

Examine privacy and security implications of copilot for security; the data remains yours, isn’t used to train models, is encrypted in transit and at rest, and isn’t shared with OpenAI.

Examine authentication and role-based access control in Copilot for security, including on behalf of authentication, plugin access, and licensing, across Copilot for security, Microsoft Entra, and Azure RBAC.

Explore the standalone and embedded copilot for security experiences, compare their use cases across Defender XDR, Intune, and Purview, and learn which fits each scenario.

This lecture explains Copilot for security pricing using security compute units, billed by the hour at about $4 per SEO, with scalable provisioning and estimated monthly costs.

Enroll in an Azure subscription, create an Entra ID tenant with roles, and provision security capacity units to deploy Copilot for security.

Deploy Microsoft Copilot for security by creating a Copilot demo resource group in Europe and configuring security compute units, with two SKUs totaling about $5,760 per month.

Explore how copilot for security uses prompts, prompt books, and plugins to analyze incidents, generate reports, and guide investigations with Defender XDR, Sentinel, and KCL queries.

Leverage Security Copilot to generate and explain KQL queries for defender XDR, including azure ad sign-in events, time filters, and query projections for incident insights.

Explore Defender for cloud, a cloud native protection platform spanning DevSecOps, cloud security posture management, and cloud workload protection across hybrid environments, with CSPM and cloud workload protection plans.

Explore how to use KQL in Defender for Cloud through workbooks and inventory, adding queries, viewing samples, and inspecting built-in dashboards, with ARM templates and the Azure Resource Graph Explorer.

Explore Sentinel, a cloud-native sim and soar, that ingests logs from cloud and on-prem sources into log analytics to detect, investigate, and respond to threats with automation.

Set up a Sentinel workspace atop a log analytics workspace and run kql queries across logs, hunting, workbooks, and analytics to enable scheduled query rules that generate alerts and incidents.