Learn KQL for Microsoft Sentinel

Learn KQL for Microsoft Sentinel, available at Free, has an average rating of 4.42, with 16 lectures, based on 168 reviews, and has 3585 subscribers.

You will learn about Learn KQL basics for Microsoft Sentinel Know the most used operators Learn to build your first query Learn to evaluate your KQL results This course is ideal for individuals who are Data Scientists It is particularly useful for Data Scientists.

Enroll now: Learn KQL for Microsoft Sentinel

Summary

Title: Learn KQL for Microsoft Sentinel

Price: Free

Average Rating: 4.42

Number of Lectures: 16

Number of Published Lectures: 16

Number of Curriculum Items: 16

Number of Published Curriculum Objects: 16

Original Price: Free

Quality Status: approved

Status: Live

What You Will Learn

Learn KQL basics for Microsoft Sentinel
Know the most used operators
Learn to build your first query
Learn to evaluate your KQL results

Who Should Attend

Data Scientists

Target Audiences

Data Scientists

Welcome to KQL for Microsoft Sentinel.

KQL is a simple query language used across multiple products like

Azure Log Analytics

Microsoft Sentinel

Azure Resource Graph

to read & write structured & unstructured data.

Course Structure

In this course we will focus on leveraging KQL for Microsoft Sentinel.

This will walk you though a basic understanding of KQL

Quick Start
Go for a quick result
Filter for better results
Leverage the joins
Summarize for perspective
Save & Reuse
Apply the visual
Build the use case

Each section has subsections for easy understanding of the topics.

A quick start happens with searching a particular phrase -> projecting the necessary columns -> extending the additional columns needed.

Now, to get a quick result we do distinct to find unique values -> use count -> get the top for display a limited set of result.

To Filter better result Apply where condition -> Apply TimeGeneated filter

Leverage the joins by learning about different kinds of joins

Summarize for perspective by Summarize -> make_list -> make_set

Once done save & reuse by saving as query or function.

Apply the visual for better visibility.

Start building you use case now with an example.

Outcome at completion

After you successfully complete this course you will be able to build your own KQL query from scratch to end.

Whom is this course for

Either you are new to Microsoft Sentinel , Log Analytics or KQL or you are already working in SOC on a regular basis, this course is for you.

Course Curriculum

Chapter 1: Introduction

Lecture 1: Introduction

Chapter 2: Quick Start

Lecture 1: Start your KQL with Search

Lecture 2: Project the required columns

Lecture 3: Extend your query to build columns on the fly

Chapter 3: Go for a quick result

Lecture 1: Use distinct to find unique values

Lecture 2: Use count for a quick output

Chapter 4: Filter for better results

Lecture 1: Apply where condition to filter better

Lecture 2: Filter your data set with TimeGeneated

Chapter 5: Leverage the joins

Lecture 1: Corelate multiple datasets with joins

Chapter 6: Summarize for perspective

Lecture 1: Summarize your data to get an overview

Lecture 2: Apply make_list to summarize all values

Lecture 3: Apply make_set to summarize unique values

Chapter 7: Save & Reuse

Lecture 1: Save your query

Lecture 2: Save your query as function

Chapter 8: Apply the visual

Lecture 1: Apply visual on a Dataset

Chapter 9: Build the use case

Lecture 1: Brute force in SignInLogs

Instructors

Samik Roy
Cloud Security Architect

Rating Distribution

1 stars: 1 votes
2 stars: 6 votes
3 stars: 27 votes
4 stars: 59 votes
5 stars: 75 votes

Frequently Asked Questions

How long do I have access to the course materials?

You can view and review the lecture materials indefinitely, like an on-demand channel.

Can I take my courses with me wherever I go?

Definitely! If you have an internet connection, courses on Udemy are available on any device at any time. If you don’t have an internet connection, some instructors also let their students download course lectures. That’s up to the instructor though, so make sure you get on their good side!

Menu