KQL for Microsoft Sentinel investigations

Skills you'll practise

• Write a query that filters on time first and returns only the columns needed
• Choose the right string operator (==, =~, in, in~, has, contains) and explain the difference between term and substring matching
• Summarize results with count(), dcount(), make_set() and arg_max() to answer investigation questions
• Use let and join, including the default innerunique and leftanti kinds, to combine tables
• Find and fix common query errors such as columns dropped by project and case-sensitive comparisons

Course outline

1. 1.Shaping results: filter, pick, calculate, summarizeLesson · 18 min
2. 2.Matching strings correctlyLesson · 17 min
3. 3.Combining tables with let and joinLesson · 20 min
4. 4.KQL for Microsoft Sentinel investigations: knowledge checkKnowledge check · 14 questions
5. 5.MFA prompts, then a sign-in from abroadScenario
6. 6.Final exam10 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: KQL quick reference
• Microsoft Learn: KQL string operators (terms, has vs contains, case sensitivity)
• Microsoft Learn: KQL join operator
• Microsoft Learn: KQL arg_max() aggregation function
• Microsoft Learn: Azure Monitor Logs reference, SigninLogs table
• Microsoft Learn: Monitor the health of your Microsoft Sentinel data connectors
• Microsoft Learn: Handle false positives in Microsoft Sentinel