The Definitive Guide to KQL: Using Kusto Query Language for operations, defending, and threat hunting

Chapter 5

KQL for Cybersecurity—Defending and Threat Hunting

After completing this chapter, you will be able to:

• Understand the advantages of using KQL day-to-day in cybersecurity

• Utilize specific operators that allow for in-depth examination of data across time intervals

• Understand how KQL can aid real-world investigations

• Use KQL operators to be able to analyze various data sources efficiently

• Combine many data sources to craft single queries

While this section of the book will have plenty of example queries we hope you can utilize in your environment, the most important thing we want you to take away is why KQL is used in cybersecurity. We want to give you the knowledge about where you can use KQL in your day-to-day life, where it can save ...