Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

KQL (Kusto): Basic Queries

This room is designed to work you through basic KQL queries for analyzing security logs.

Task 1: Introduction

Task 2: SQL and KQL Comparison

Task 3: Using the Where and Sort Operators

Task 4: Using the Search Operator

Task 5: Using Let Statement for Declaring Variables

Task 6: Using Time Functions

Task 7: Using the Summarize and Render Operator

Task 8: Lab Instructions

Task 9: Lab-01: Investigate and Identify

Task 10: Conclusion

Back to all walkthroughs
Room Icon

KQL (Kusto): Basic Queries

Max room.

This room is designed to work you through basic KQL queries for analyzing security logs.

easy

60 min

2,129

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Let's delve into security log analysis with some basic queries. These queries target logs of different types, and with little practice, you will be able to use KQL like a professional, analyzing logs and performing threat hunting activities to keep your organization safe.

A humanoid robot is seated at a desk, working on a computer with two monitors.

Learning Objectives

  • Understanding the difference between and KQL
  • How to use the where operator to find suspicious events
  • How to use the search and summarize operators
  • Using the let statement to declare variables

Learning Prerequisites

Answer the questions below
Let's go!