
The Definitive Guide to KQL
Description
Alles über E-Books | Antworten auf Fragen rund um E-Books, Kopierschutz und Dateiformate finden Sie in unserem Info- & Hilfebereich.
Solve real problems with Kusto Query Language- and build your competitive advantage:
Learn the fundamentals of KQL-what it is and where it is used
Examine the anatomy of a KQL query
Understand why data summation and aggregation is important
See examples of data summation, including count, countif, and dcount
Learn the benefits of moving from raw data ingestion to a more automated approach for security operations
Unlock how to write efficient and effective queries
Work with advanced KQL operators, advanced data strings, and multivalued strings
Explore KQL for day-to-day admin tasks, performance, and troubleshooting
Use KQL across Azure, including app services and function apps
Delve into defending and threat hunting using KQL
Recognize indicators of compromise and anomaly detection
Learn to access and contribute to hunting queries via GitHub and workbooks via Microsoft Entra ID
More details
Other editions
Additional editions

Persons
Rod Trent is a senior program manager at Microsoft, focused on cybersecurity and AI. He has spoken at many conferences over the past 30-some years and has written several books, including Must Learn KQL: Essential Learning for the Cloud-focused Data Scientist, and thousands of articles. He is a husband, dad, and first-time grandfather. In his spare time (if such a thing does truly exist), you can regularly find him simultaneously watching Six Million Dollar Man episodes and writing KQL queries. Rod can be found on LinkedIn and X (formerly Twitter) at @rodtrent.
Matthew Zorich was born and raised in Australia and works for the Microsoft GHOST team, which provides threat-hunting oversight to many areas of Microsoft. Before that, he worked for the Microsoft Detection and Response Team (DART) and dealt with some of the most complex and largest-scale cybersecurity compromises on the planet. Before joining Microsoft as a full-time employee, he was a Microsoft MVP, ran a blog focused on Microsoft Sentinel, and contributed hundreds of open-source KQL queries to the community. He is a die-hard sports fan, especially the NBA and cricket.
Content
CHAPTER 1 Introduction and Fundamentals
CHAPTER 2 Data Aggregation
CHAPTER 3 Unlocking Insights with Advanced KQL Operators
CHAPTER 4 Operational Excellence with KQL
CHAPTER 5 KQL for Cybersecurity-Defending and Threat Hunting
CHAPTER 6 Advanced KQL Cybersecurity Use Cases and Operators
System requirements
File format: PDF
Copy protection: Watermark-DRM (Digital Rights Management)
System requirements:
- Computer (Windows; MacOS X; Linux): Use the free software Adobe Reader, Adobe Digital Editions, or any other PDF viewer of your choice (see eBook Help).
- Tablet/Smartphone (Android; iOS): Install the free app Adobe Digital Editions or another reading app for eBooks, e.g., PocketBook (see eBook Help).
- E-reader: Bookeen, Kobo, Pocketbook, Sony, Tolino and many more (only limited: Kindle).
The file format PDF always displays a book page identically on any hardware. This makes PDF suitable for complex layouts such as those used in textbooks and reference books (images, tables, columns, footnotes). Unfortunately, on the small screens of e-readers or smartphones, PDFs are rather annoying, requiring too much scrolling.
This eBook uses Watermark-DRM, a „soft” copy protection. This means that there are no technical restrictions to prevent illegal distribution. However, there is a personalised watermark embedded in the eBook that can be used to identify the purchaser of the eBook in the event of misuse and to provide evidence for legal purposes.
For more information, see our eBook Help page.