From the Publisher

Who should read this book?

This book is for anyone leveraging Microsoft cloud resources such as Azure or Microsoft365 suite of products, including administrators, engineers, architects, and even developers who want to be able to monitor and understand what is happening in their environment and then use those insights to take action to improve the environment. It’s also for information security professionals who can monitor and take action on malicious activity as quickly and efficiently as possible.

Foreword written by Ann Johnson, Corporate Vice President, Security, Microsoft

"Data is ubiquitous—generated by and flowing between applications, devices, users, and systems. It can provide valuable insights into the performance, behavior, and security of one’s environment. However, accessing, analyzing, and acting on this data can be challenging. How can you turn it into actionable intelligence that can help optimize operations, enhance security, and solve problems?

One solution is KQL—Kusto Query Language—a powerful and expressive language that enables the querying and manipulation of large volumes of data in Azure Data Explorer, Azure Monitor, Azure Sentinel, and other Microsoft data platforms. KQL can help perform complex queries, apply advanced functions, and leverage operators to transform data into meaningful information. KQL can also help visualize data, create dashboards, and automate workflows.

KQL is critical for a modern cybersecurity team. It allows defenders to detect and respond to threats, anomalies, and incidents in near real-time. Whether a beginner or an expert, this book will teach everything readers need to know about KQL, including the fundamentals of the language, such as its syntax, functions, and operators. Readers will also learn how to write efficient and effective queries and manipulate and transform data.

In the later chapters, this book covers common security investigations using KQL and recommendations on leveraging KQL queries before these incidents occur. Readers will see these queries are just the beginning of what is possible with KQL. In the concluding chapter, the authors offer perspective on contributing their own KQL queries to the community, supporting the “team sport” of security.

This book is based on the experience and expertise of Mark, Matt, and Rod, Microsoft employees and KQL experts. They have authored this book to help individuals master KQL and to help organizations use the technology to improve their operational and security posture with data. Readers will also benefit from the additional queries and content contributed by different product managers, service engineers, and cloud solution architects who use KQL daily.

Readers will find this to be a practical guide—enabling readers to follow along, run included queries in their own environment, or use the sample datasets provided by the authors and help apply learnings."