Kusto Query Language (KQL) is used to query Azure services such as Sentinel, Log Analytics, and Azure Data Explorer.
Resources
- KQL Search - search engine for community KQL queries
- rod-trent/MustLearnKQL - code included as part of the MustLearnKQL blog series
- rod-trent/SentinelKQL: LabKQL
- Fun With KQL – Distinct – Arcane Code
Example queries
- Sentinel - audit log and Defender queries
- Azure WAF - Application Gateway firewall queries
- Access Packages - entitlement management policy change queries