Microsoft Sentinel - KQL Fundamentals

Name: Microsoft Sentinel - KQL Fundamentals
Uploaded: 2026-11-02T00:00:00.000Z
Duration: 6 min 18 s
Description: Every investigation in Microsoft Sentinel eventually comes down to a query. In this five-minute byte, follow an analyst at company as four million sign-in rows become a short answer. You will learn to read a query, filter, project, and summarize, keep queries fast, and adapt a saved query in the Defender portal, so you can answer questions faster.

Every investigation in Microsoft Sentinel eventually comes down to a query. In this five-minute byte, follow an analyst at company as four million sign-in rows become a short answer. You will learn to read a query, filter, project, and summarize, keep queries fast, and adapt a saved query in the Defender portal, so you can answer questions faster.

What You Will Learn

How a query starts with a table and flows through pipes
Why the order of operators changes the answer
How to read a saved query one step at a time
How where, project, and summarize shape the rows
How the ago function keeps the time range you need
How top, sort, and take rank and limit results
Which habits keep queries fast and results reliable
How to adapt a saved query to a new question
Where to run KQL in the Defender portal

Microsoft Sentinel - KQL Fundamentals

What You Will Learn

Contributors