Learning path
Microsoft Sentinel - KQL Fundamentals
Skill Level
Fundamentals
Duration 10 minutes
Updated Nov 1, 2026
About this learning path
In this ATC byte, you will learn how a query starts with a table and flows through pipes. You will see how three simple moves, filter, project, and summarize, turn millions of rows into a short answer. You will also pick up the habits that keep queries fast, adapt a saved query to a new question, and learn where to run KQL in the Defender portal.
Your instructors
Prerequisites
- Log and table basics: Know that Microsoft Sentinel keeps security logs in tables, such as sign-in and security event records.
- The Defender portal: Know your way around the Microsoft Defender portal, including the Hunting menu and the Microsoft Sentinel section.
- Rows and columns: Comfort filtering, sorting, and counting in a spreadsheet or a database. SQL experience is not required.
- Reader access: Access to a Microsoft Sentinel workspace, such as the Microsoft Sentinel Reader role, so you can query its data.
What you'll learn
- How a query starts with a table and flows through pipes.
- Why the order of operators changes the answer
- How to read a saved query one step at a time
- How where, project, and summarize shape the rows
- How the ago function keeps the time range you need
- How top, sort, and take rank and limit results
- Which habits keep queries fast and results reliable
- How to adapt a saved query to a new question
- Where to run KQL in the Defender portal