KQL for Detection and Threat Hunting

What KQL for Detection and Threat Hunting teaches: the query language behind every hunt, detection, and investigation in Microsoft Sentinel, Defender XDR, and Log Analytics.

The tabular data model, the query pipeline, every data type, type conversion, and null handling.

Master every where operator, string comparison, datetime filter, extend pattern, and project variant.

Every summarize function, time-based grouping with bin, set and list aggregations, ordering and limiting, and pivot patterns.

Every join flavour with performance implications, union for combining tables, lookup for enrichment, and cross-table investigation patterns that trace attacks across data sources.

Parse, extract, parse_json, string manipulation, URL decomposition, and building log parsers.

Regular expressions, dynamic arrays with mv-expand and mv-apply, the let statement, user-defined functions, and externaldata.

Make-series, series decomposition, automated anomaly detection, statistical analysis, baseline comparison patterns, and building anomaly detection rules from raw logs.

Entity relationships, attack path reconstruction, network graph patterns, identity mapping, and recursive multi-hop investigation queries.

Query engine internals, performance analysis, materialized views, optimizing for large datasets, common anti-patterns, and writing queries that scale from development to production.

Converting investigation queries into production detection rules.

Hypothesis-driven hunting methodology, MITRE ATT&CK hunting, behavioral hunting with baseline deviation and peer group analysis, IOC sweeps, and building a reusable hunting query library.

KQL for Sentinel workbooks with parameterized queries, building the security operations dashboard, executive reporting queries, and automated report generation.

Three complete hunting scenarios that test every skill from the course.

Seventy-four queries across ten subject-area sheets, each with the operators it turns on and what the result does not establish.

Five procedures for the recurring problems, worked against documented platform behavior: ingestion lag, table plans, memory and truncation limits, service limits on rules, and transformation constraints.

A Log Analytics workspace you build and populate yourself, free, with the activity each module's queries need and the verification that proves it holds data.

Ten investigations worked end to end with the output at every step, each turning on a failure that produces no error message: queries that return nothing, too few rows, or exactly the right answer to the wrong question.

Five query patterns by investigative question, each built on the function KQL actually provides for it, with the constraint that decides the design and the false positives it will produce.

Resources for practicing KQL and using it at work: the detection library, a free-run query console, guided investigations, response playbooks, and an open-source DFIR toolkit.

External sources this course draws on: Microsoft KQL documentation, the language reference, and community query material.

KQL for Detection and Threat Hunting end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.