Kusto Query Language (KQL)

Explore the Azure global backbone that spans 60 regions with fiber and subsea cables, region pairs, availability zones, and data residency considerations.

Explore Azure regions, data centers, and the global backbone; learn how to read region attributes such as availability zones, pad region, geography, and compliance status like GDPR and HIPAA.

Discover the Azure resource hierarchy, from root management groups to subscriptions and resource groups, and learn how governance, inheritance, and policy enforce security, cost control, and compliance.

Explore azure subscription types: free with 200 credits for 30 days and some 12-month free services; student with 12 months free and no card; pay-as-you-go; enterprise agreement.

Explore Entra ID tenants and Azure environments, clarifying that Entra ID identity services aren't always tied to Azure resources and can serve human identities, managed identities, and app registrations.

Create your Azure subscription with free, pay-as-you-go, or student options, sign in with a Microsoft account, and access 12 months of services plus 55 always-free services and 200 USD credit.

Learn to inspect and manage the Azure resource hierarchy, create and rename subscriptions, add a new management group, and set up a resource group for demos.

Create and configure an Azure cost management budget for a subscription, set monthly billing, define a threshold, and enable alerts on actual or forecasted usage.

Learn the kusto query language (kql) to query large data sets across Azure Log Analytics, Microsoft Sentinel Defender XDR, and Microsoft Fabric using pipe-based filtering, aggregations, and joins.

Begin with a hypothesis about an IP address in logs, identify tables like network and devices, then filter, summarize, and visualize for evidence.

Explore the most important KQL operators, including where, render, union, join, extend, and project, and learn how to combine, visualize, and manipulate data across tables.

Explore the Azure Log Analytics service, its workspace backbone, and how KQL queries interact with ingested logs across Azure Monitor, Sentinel, Defender for Cloud, and Logic Apps.

Learn how data retention works in log analytics: manage workspace tables across analytic, basic, and auxiliary tiers and understand tier impact on kql queries.

Explore how the table schema in log analytics defines a table's structure with columns and data types, and use the get schema operator in KQL to inspect it.

Set up a lab with a windows vm and log analytics workspace; ingest windows event and Azure Activity logs into event, heartbeat, and Azure Activity tables, then query with kql.

Configure your Azure environment by creating a resource group and a Log Analytics workspace. Configure a data collection rule to ingest Windows event logs; enable diagnostic settings for Azure activity.

Create and delete a resource group and stop and start a virtual machine to generate Azure activity logs, then query the resulting logs in the Azure portal.

Download the section-specific KQL code files and install Visual Studio Code with the couscous extension for Castro syntax highlighting.

Learn to filter and search data in KQL using where, contains, has, search, take, case, and distinct, with an example filtering events by an event ID.

Master the where operator in Kusto query language (kql) using Log Analytics to filter events, heartbeat data, and Azure Activity data with pipes, time frames, and chained conditions.

Learn to use where with contains, has, has any, and has all in KQL to filter Azure Activity logs by strings, case sensitivity, and substrings.

Learn how to use the kql search operator to find a string across all tables, and why it’s slow for large logs; optimize with where, wildcard, and multi-table searches.

Limit the take operator to the first ten records to improve performance, and pair it with where to filter for specific events.

Learn to use the extend and case operators in KQL to create a severity column from event level, mapping 1–4 to critical, error, warning, and information.

Explore the distinct operator in Kusto query language to extract unique values, demonstrating distinct by computer, distinct operation names, and combining with where and take for the last seven days.

Learn to apply KQL date and time functions using operators like where, format_datetime, bin, and ago to filter and format events from the last hour in the heartbeat table.

Master the Kusto query language date and time functions, using the Ago operator to filter heartbeats by time ranges and to compute hours since last heartbeat with where and extend.

Extend time_generated to create date or time formats using format_datetime in Kusto, producing readable date only, custom formats, and month or year extractions.

Use the bin operator to round values to fixed time buckets and group time generated into hourly or five-minute windows. Pair bin with summarize count for events.

Master KQL column management with project variants like project away and project rename, and extend to add new columns, demonstrated on the heartbeat table's computer, OS type, and time generated.

Explore the print operator in KQL to output messages, timestamps, and computed values using now, ago, and basic arithmetic; learn string concatenation with strcat and build hello world examples.

Explore the project operator in kql on heartbeat and activity tables to select, rename, and calculate columns such as event time and duration minutes using time received and time generated.

Master the project-away operator in Kusto Query Language (KQL) by removing unwanted columns, such as resource ID and subscription ID, while keeping the source column.

Explore the Kusto query language project keep operator to selectively preserve columns with wildcards, compare it to project, and apply it to event-related columns and time generated.

Use project rename to keep all columns while renaming selected fields, then apply where filters to explore results across the last twenty four hours and seven days.

Use the project reorder operator in KQL to bring key columns like event level, source, and time generated to the front, using a wildcard to keep the rest in place.

Extend creates new columns and computes values dynamically, enabling minutes since heartbeat and day of week, with conditional logic and string operations, and can pair with project for temporary columns.

Explore KQL operators for sorting and aggregating data, including top, summarize, count, join, union, and range, and learn to structure results across tables.

Explore the sort by operator in kql to order outputs by time generated or other columns, using ascending or descending order and multi-column sorting.

Explore the count operator in KQL by counting heartbeats and filtering with where to count events by level, including Azure activity in the last 24 hours.

Learn to use the summarize operator in KQL for log aggregations. Count events by source, compute last heartbeat, and apply min, max, and bin with multi-table examples.

Learn how the top operator in kql aggregates, groups, and sorts data, showcasing top by time generated and by event level on heartbeat and Azure activity tables.

Use the union operator in kql to combine rows from two tables, such as event and Azure activity. Filter with where to target specific event levels and see unified results.

Learn how inner join in KQL combines rows from heartbeat and event tables using join keys, producing records present in both sides and highlighting computers with heartbeats and events.

Learn how the left outer join in kusto query language returns all left table records with right table entries and nulls for unmatched rights, plus an event count by computer.

Explore the right outer join in kusto query language (kql), compare it with the left outer join, and project computer, OS type, and source from events in last 24 hours.

Learn how a full outer join returns all records from heartbeat and event tables and assigns status as in both, heartbeat only, or events only.

Demonstrate the antijoin in kql by listing computers with heartbeats but no events in the last 24 hours, using a left anti join and distinct computer output.

Explore the range operator in Kusto Query Language (KQL) to dynamically generate numbers, extend datasets with computed columns like square, and reference ranges for days of week and weekend logic.

Explore KQL operators that restructure data, including lookup, parsing, and temporary variables, and render visualizations like time charts for insights from tables such as heartbeat.

Learn how the let operator in KQL creates temporary variables and references them as tables or scalars, with examples like recent events, heartbeat timing, and date time difference.

Explore the parse operator in kusto query language to extract fields from strings into new columns, using sample event descriptions and ip address parsing for observability and security workflows.

Learn to use the render operator in KQL to create time charts and other visualizations from heartbeat and event data, with chart and table views.