KQL
noun · also Kusto Query Language
The read-only query language used by Microsoft Sentinel, Defender XDR advanced hunting, Azure Monitor and Azure Data Explorer.
Kusto Query Language (KQL) is how you ask questions of log data across Microsoft's security and monitoring tools. A query starts with a table and passes the data through a pipeline of operators separated by |: filter with where, choose columns with project, aggregate with summarize, and so on. It reads top to bottom, much like a sentence.
Example
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize Failures = count() by UserPrincipalName
| top 10 by FailuresThis returns the ten accounts with the most failed sign-ins in the last day.
Why it matters for a SOC analyst
In a Microsoft environment, almost every investigation, hunt and detection rule is written in KQL. You do not need to master the whole language to be effective: where, project, summarize, extend, join and time filters cover most daily work. Keep a personal library of queries that worked, and reuse them.
Articles that use this term
Certifications · · 3 min read
SC-200 study plan for SOC beginners
A six-week plan to prepare for Microsoft's Security Operations Analyst exam: what to study each week, how to practice for free, and the KQL you need to know.
Tutorials · · 4 min read
Investigating a suspicious sign-in in Entra ID, step by step
What to check in the sign-in logs, which KQL queries to run, how to compare against the user's normal behavior, and when to revoke sessions and reset access.
Related terms
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Threat hunting
The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.