Kusto Query Internals Azure Sentinel Reference
?
Kusto Query Internals ¨C Azure Sentinel Reference
Author
Contact
Huy Kha
Huy_Kha@
Summary
This documentation is about Kusto Query Language (KQL) with a primary focus on targeting the
Security Analysts audience. KQL can be used by Security Analysts to search for security events at
a large scale, which makes it very useful to have a basic understanding of it.
Cloud & Security Administrators who manage Azure AD & Office365 can use this document as
well to understand on how to search for different activities in their Cloud environment. We will
cover a few examples such as finding activities in Azure AD, Exchange & SharePoint ¨C Online.
The purpose of this documentation is to provide a basic understanding on how the structure of
KQL works with ''hands-on'' examples. It walks you through the different steps on searching and
analyzing different datasets, and last, but not least. There is a homework section at the end of
this document to make sure that you also practice it hands-on.
There is nothing ''advanced'' here, because the focus is on using common KQL operators in
practice, and not the rare ones. That you might only use once a while.
? What will you learn?
Summary:
The goal is to teach you how to use KQL to search for different datasets. However, this doesn't
mean, that I will teach you every specific KQL operator or other fancy tricks.
This documentation is based on different use-cases from data sources, such as Azure AD,
Exchange, SharePoint, Sysmon, Windows Security Events, and Active Directory.
Every chapter contains a data source that I will cover with different use-cases, and after the usecases has been described. A KQL query needs to be written to search for it in the logs.
One of the best way to learn KQL is to look at examples and do it by yourself. It is not difficult,
but it requires some practice to get the feeling.
At the end of the day, I hope that you will learn something from it. What's even better is, if you
could improve the KQL queries in this document. We all can learn from each other, so I don't
claim that this document is perfect.
What you also will notice is that we will repeat a lot of stuff in all the chapters :)
? Chapters
?
1.1)
1.2)
1.3)
1.4)
1.5)
1.6)
1.7)
Kusto
What is Kusto Query Language?
Schema of KQL
Examples of KQL operators
Examples of common string operators
Examples of scalar functions
Examples of two aggregation functions
Extra KQL knowledge and tips
?
2.1)
2.2)
2.3)
Exchange Online
Mail forwarder rule on inbox
Full Access delegated on a mailbox
User added to Exchange Admin role
?
3.1)
3.2)
SharePoint Online
Site Collection Admin added
User Folder shared
?
4.1)
4.2)
4.3)
Azure Active Directory
User gave approval on Global Admin role via PIM
Azure Key Vault Secret was accessed
Azure Identity Protection
?
5.1)
5.2)
Sysmon
Hunting a Living-off-the-land binary
Disable UAC via Registry
?
6.1)
SecurityEvent
Hunting a Living-off-the-land binaries with Windows events
?
7.1)
MDAPT
Parse metadata from MDAPT
?
8.1)
8.2)
Active Directory
Hunting for DCSync activities
Kerberoast (Honey User Account)
?
9.0)
Offensive PowerShell
Malicious PowerShell activities
? KQL ¨C Operators discussed
?
Tabular Operators
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.9.1
1.3.9.1
1.3.9.3
1.3.9.4
1.3.9.5
1.3.9.6
?
1.4
1.4.1
1.4.2
1.4.3
Where
Or
And
Count
Project-away
Project
Search
Limit
Distinct
Summarize any(*) by
Summarize count() by
Parse
Project-rename
Sort
Render
String Operators
Contains
Matches regex
Has
in
? KQL ¨C Functions discussed
?
Scalar functions
1.5
1.5.1
1.5.2
1.5.3
1.5.4
?
1.6
1.6.1
Parse_json()
Base64_decode_string()
Ago()
Todatetime()
Parse_xml()
Aggregation functions
Dcount()
Dcountif()
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related searches
- azure sql vs azure sql database
- north sentinel island tribe
- north sentinel island people
- population of north sentinel island
- north sentinel island wildlife
- where is north sentinel island
- north sentinel island history
- new sentinel island
- north sentinel island women
- high standard sentinel revolvers value
- orlando sentinel daily crossword puzzle
- high standard sentinel r 101