Prepare for SC-200 with a reference that remembers your progress.

Kusto Query Language (KQL) is the read-only query language behind Microsoft Sentinel logs, analytics rules, workbooks, and hunting. This module establishes the operators used to retrieve, filter, transform, sort, and shape security data.

A KQL query is a sequence of statements. A tabular expression begins with a data source and sends its rows through operators separated by the pipe character. Each operator receives the complete result produced on its left.

SecurityEvent
| where TimeGenerated > ago(1d)
| summarize Events = count() by Account
| top 10 by Events desc

The Microsoft Log Analytics demo environment can be used for practice; its data changes continuously, so widen the time range when a sample returns no rows.

search looks for text across multiple tables and columns. It is useful during discovery when you do not yet know the schema, but it is less efficient than querying a known table and filtering a known column.

search "err"

search in (SecurityEvent, SecurityAlert, A*) "err"

where returns only rows whose Boolean predicate is true. Filter time and high-selectivity fields early to reduce the amount of data processed by later operators.

SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID in (4624, 4625)
| where AccountType =~ "user"

• == is case-sensitive; =~ is case-insensitive.
• in (...) tests a value against a list.
• Multiple where operators can make complex logic easier to read.

let binds a name to a scalar value, tabular expression, dynamic list, view, or function. It improves readability, reuse, and consistent thresholds. Each declaration ends with a semicolon.

let timeframe = 7d;
let suspiciousEvents = dynamic([4625, 4672]);
SecurityEvent
| where TimeGenerated > ago(timeframe)
| where EventID in (suspiciousEvents)

A tabular expression can also be assigned to a name and referenced later as if it were a table. ago() calculates a time relative to the query execution time.

extend calculates one or more columns and appends them to the current result. Existing columns remain unless they are later removed with a project operator.

SecurityEvent
| where ProcessName != "" and Process != ""
| extend StartDir = substring(
    ProcessName, 0,
    string_size(ProcessName) - string_size(Process))

Use it to normalize fields, convert data types, calculate risk flags, or derive fields needed for grouping and correlation.

order by (or sort by) sorts the result by one or more columns. The default direction is descending; specify asc or desc explicitly for clarity.

SecurityEvent
| order by TimeGenerated desc, Computer asc

Sorting can be expensive on large datasets, so filter and project before ordering whenever possible.

SecurityEvent
| where EventID == 4625
| project TimeGenerated, Computer,
          User = Account, IpAddress

Be ready to select the correct operator: search for unknown locations, where for row filtering, let for reusable expressions, extend for calculated columns, order by for sorting, and project for output shape.

Build readable queries from left to right, apply selective filters early, name reusable logic, derive only necessary fields, and finish with a narrow result schema.