qnd:azure:kusto_query_language_kql

This is an old revision of the document!


Kusto Query Language (KQL)

Queries

Select records where a column does not contain any of the listed substrings

SecurityEvent
| where not(Computer has_any ("mgmt", "imagine"))

Alternate form that works for a single substring match

SecurityEvent
| where not(Computer contains "mgmt")
  • qnd/azure/kusto_query_language_kql.1633357536.txt.gz
  • Last modified: 2021/10/04 14:25
  • by mgupton