Table of Contents

Kusto Query Language (KQL)

Queries

Select records where a column does not contain any of the listed substrings 

SecurityEvent
| where not(Computer has_any ("mgmt", "imagine"))

Alternate form that works for a single substring match 

SecurityEvent
| where not(Computer contains "mgmt")
SecurityEvent
| where Computer !contains "mgmt"

List All Tables

union withsource = table *
| summarize count() by table
| sort by count_ desc

summarize

Get a count of records based on summarizing a specified column 

Event
| where not(Computer has_any ("mgmt", "imagine"))
| summarize count() by Computer

Get unique values from the specified column 

SecurityEvent
| distinct Computer

Windows Events Aggregated

SecurityEvent
| summarize count() by tostring(EventID), Activity, Computer
| order by count_ desc

Palo Alto firewall logs

CommonSecurityLog
| summarize count() by ApplicationProtocol
| order by count_ desc
CommonSecurityLog
| summarize Count=count() by ApplicationProtocol
| order by Count desc

Related