KQL for Security Analysts

KQL for Security Analysts: the query language of Microsoft Sentinel and Defender, taught against one month of an engineering company's records with several real attacks in them. What KQL is, how security data is stored, the tables analysts query, the two places queries run, a first query, the practice lab, how the course climbs from basics to mastery, and a six-scenario check of whether it fits you.

Module 1 of KQL for Security Analysts: how a KQL query is built from statements and a pipe of tables, how to explore a table and choose its columns, the ten scalar types, conversion, null and empty values, and a six-pass method for reading a query someone else wrote.

Module 2 of KQL for Security Analysts: finding where a value lives with search and find, narrowing a table with where, matching text the way the engine indexes it, working in time windows and around an event, and filtering addresses, nested fields and negations without losing rows.

Module 3 of KQL for Security Analysts: deriving new values with extend, classifying rows with iff and case, cleaning text, working with time formats, choosing and naming columns, ordering and limiting, removing duplicates, and shaping a result for the person who will act on it.

Module 4 of KQL for Security Analysts: how summarize builds a result, counting and distinct counting, describing distributions with medians and percentiles, conditional aggregates, lists and sets, binning activity over time, rates and denominators, and drawing aggregates as charts with render.

Module 5 of KQL for Security Analysts: stacking tables with union, matching rows with join, the default innerunique join, outer, anti and semi joins, lookup and reference tables, joining events across time, and checking that a join returned the right answer.

Module 6 of KQL for Security Analysts: pulling fields out of free text with parse, key-value logs, regular expressions and extract, indicators and encoded commands in text, JSON and the dynamic type, property bags, and turning arrays into rows with mv-expand and mv-apply.

Module 7 of KQL for Security Analysts: naming values and intermediate results with let, materialize, writing functions, parsers as functions, watchlists, externaldata, matching indicators in every format, and IP address functions and ranges.

Module 8 of KQL for Security Analysts: make-series and the zeros it keeps, series arithmetic and statistics, reading series function output, comparing periods, series per entity, row order with serialize, prev and next for sessions, and running totals.

Module 9 of KQL for Security Analysts: relationships as nodes and edges, make-graph, graph-match patterns, variable-length paths with map, all, any and inner_nodes, process trees, identity paths, machine-to-machine connections, and when a join is the better tool.

Module 10 of KQL for Security Analysts: how a query runs, filtering early, the cost of string operators, joins and summaries at scale, documented limits, adapting public queries, checking answers for silent zeros and data gaps, and checking AI-written KQL.

One sheet per module of KQL for Security Analysts, each entry a question, a query that answers it against the sample month, what to read and what the answer does not prove.

Procedures for the three problems every KQL user meets: a query that returns nothing, a query that is too slow, and a log source nobody has parsed.

The course's practice lab, which needs no setup, and how to get a workspace of your own to run the course's queries and the Project against.

Six investigations worked end to end with the output at every step, five of them turning on a query that ran cleanly and answered wrongly.

Five query patterns that recur across security questions: first time seen, rare in population, volume anomaly per entity, paired events in sequence, and regularity.

Resources for practicing KQL and using it at work: the detection library, a free-run query console, guided investigations, response playbooks, and an open-source DFIR toolkit.

Every operator, function, check and limit from KQL for Security Analysts in one place, organized by the task in front of you and linked back to the section that explains it.

The documentation behind KQL for Security Analysts, arranged by the question it answers: the language, where queries run and their limits, getting data, and community query material.

The KQL for Security Analysts project: a brief for a library of twenty queries you build on your own data, each answering a stated question, each checked, with its table's pitfalls and its cost noted, and one taken to the quality of a scheduled rule. No submission, no grading.

KQL for Security Analysts end-of-course exam: twenty tasks, two per teaching module, each answered by writing KQL against the course's sample month and checked on the server.