Detection & response
KQL
Kusto Query Language
Microsoft's pipe-based, read-only query language used in Sentinel, Defender XDR, Azure Data Explorer and Log Analytics.
KQL starts from a table and pipes rows through operators: where, project, extend, summarize, join, make-series. Time functions (ago(), bin()) and series analysis make it strong for baselining and anomaly hunting.
For investigations, filter on time and indexed columns first, then narrow; summarize early to keep results small. Watch join defaults (the default kind is innerunique, which deduplicates the left side) and case sensitivity (== is case-sensitive, =~ is not; has matches whole terms and is faster than contains).
SigninLogs
| where TimeGenerated > ago(1d) and ResultType == 0
| summarize Countries = dcount(tostring(LocationDetails.countryOrRegion)),
Apps = make_set(AppDisplayName, 10) by UserPrincipalName
| where Countries > 2
| order by Countries desc