qnd:azure:kusto_query_language_kql

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
qnd:azure:kusto_query_language_kql [2021/11/12 17:46] – mguptonqnd:azure:kusto_query_language_kql [2022/08/25 15:46] (current) – [Kusto Query Language (KQL)] mgupton
Line 1: Line 1:
 ====== Kusto Query Language (KQL) ====== ====== Kusto Query Language (KQL) ======
   * #azure #sentinel   * #azure #sentinel
 +  * [[azure:qnd:KQL for Resource Graph Explorer]]
   * [[https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/sqlcheatsheet]]   * [[https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/sqlcheatsheet]]
   * [[https://github.com/reprise99/Sentinel-Queries]]   * [[https://github.com/reprise99/Sentinel-Queries]]
Line 23: Line 24:
 </code> </code>
  
-=== List All Tables ===+==== List All Tables ====
  
 <code> <code>
Line 48: Line 49:
  
  
-=== Palo Alto firewall logs ===+ 
 + 
 +==== Windows Events Aggregated ==== 
 +<code> 
 +SecurityEvent 
 +| summarize count() by tostring(EventID), Activity, Computer 
 +| order by count_ desc 
 +</code> 
 + 
 + 
 +==== Palo Alto firewall logs ====
   * Aggregating on ApplicationProtocol   * Aggregating on ApplicationProtocol
   * Example of aggregating and sorting   * Example of aggregating and sorting
Line 63: Line 74:
 | order by Count desc | order by Count desc
 </code> </code>
 +
 +====== Related ======
 +  * [[:azure_sentinel|Azure Sentinel]]
 +
  
  • qnd/azure/kusto_query_language_kql.1636739182.txt.gz
  • Last modified: 2021/11/12 17:46
  • by mgupton