Back to all walkthroughs
KQL (Kusto): Advanced Queries
Learn about advanced KQL queries and how to leverage the power of Microsoft KQL.
medium
To access material, start machines and answer questions login.
This room is a continuation of the (Kusto): Basic Queries room. However, we will discuss advanced KQL queries, and, as before, we will run as many queries as possible to ensure you are familiar with the different KQL operators and functions for threat analysis. Basic KQL queries provide a good foundation for security analysis in Microsoft Sentinel, but for in-depth threat hunting and incident investigation, advanced KQL knowledge is required.
Prerequisites
- It is strongly recommended to have finished the MS Sentinel module
- Having completed the KQL (Kusto): Introduction room
- Having completed the KQL (Kusto): Basic Queries room
Learning Objectives
- How to use the join operator
- How to use the union operator
- How to use the project operator
- How to use the extend operator
- How to create parsers and use the parse operator
Answer the questions below
I am ready to go advanced!
Ready to learn Cyber Security?
The KQL (Kusto): Advanced Queries room is only available for Premium or Max subscribers. Signup now to access more than 500 free rooms and learn cyber security through a fun, interactive learning environment.
Already have an account? Log in