Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete−
Learning path 04 · Create queries for Microsoft Sentinel using KQL ↗

4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions

0%

Study focus

KQL foundations

Build statements with filtering, projection, aggregation, time operations, and visualization.

Investigation queries

Analyze multi-table data with joins, unions, parsing, reusable functions, and Sentinel security context.

4 modules · 29 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

03Build multi-table statements using KQL0/5 units−
03

Module 3

Build multi-table statements using KQL

Focus: appending rows from related schemas and correlating rows through matching keys.
0/5
01 / 05Introduction

Security investigations rarely stay inside one table. KQL provides union to combine event streams vertically and join to correlate tables horizontally by shared attributes.

Official moduleMulti-table objectives
02 / 05Use the union operator

union appends rows from two or more tabular expressions. Columns with compatible names and types align; other columns are null where a source does not provide them.

union withsource=SourceTable Security*
| summarize Events = count() by SourceTable

Wildcards can include many tables. withsource adds source provenance, which is important when analyzing heterogeneous results. Parentheses let one union leg run its own subquery before its rows are appended.

Official lessonAppend tables and preserve source
03 / 05Use the join operator

join matches rows from a left and right tabular expression by one or more keys, then returns columns according to the selected join flavor.

SigninLogs
| where ResultType != 0
| project UserPrincipalName, IPAddress, TimeGenerated
| join kind=inner (
    IdentityInfo
    | project AccountUPN, Department
) on $left.UserPrincipalName == $right.AccountUPN
Join flavorResult
innerEvery combination of matching rows.
inneruniqueDeduplicates the left side by key before matching; the default.
leftouterEvery left row plus matching right data; null when absent.
leftsemiLeft rows that have a match.
leftantiLeft rows that do not have a match.
fullouterAll rows from both sides, matched where possible.
Exam takeaway: filter and project both sides before joining, and place the smaller dataset on the left when practical.
Official lessonCorrelation keys and join flavors
04 / 05Module assessment

Choose union when you need rows from several event sources in one stream. Choose join when you need to enrich or correlate rows using a shared key. Know how join flavor controls unmatched records.

Official assessmentMulti-table knowledge check
05 / 05Summary and resources

Combine tables intentionally: append comparable events with source attribution, or correlate reduced datasets on reliable entity keys.

Official moduleSummary and resources
End of learning pathCreate queries for Microsoft Sentinel using KQL
↑