Turn the avalanche of raw data from Azure Data Explorer, Azure Monitor, Microsoft Sentinel, and other Microsoft data platforms into actionable intelligence with KQL (Kusto Query Language). Experts in information security and analysis guide you through what it takes to automate your approach to risk assessment and remediation, speeding up detection time while reducing manual work using KQL. This accessible and practical guidedesigned for a broad range of people with varying experience in KQLwill quickly make KQL second nature for information security. Solve real problems with Kusto Query Language and build your competitive advantage: Learn the fundamentals of KQLwhat it is and where it is used Examine the anatomy of a KQL query Understand why data summation and aggregation is important See examples of data summation, including count, countif, and dcount Learn the benefits of moving from raw data ingestion to a more automated approach for security operations Unlock how to write efficient and effective queries Work with advanced KQL operators, advanced data strings, and multivalued strings Explore KQL for day-to-day admin tasks, performance, and troubleshooting Use KQL across Azure, including app services and function apps Delve into defending and threat hunting using KQL Recognize indicators of compromise and anomaly detection Learn to access and contribute to hunting queries via GitHub and workbooks via Microsoft Entra ID
Turn the avalanche of raw data from Azure Data Explorer, Azure Monitor, Microsoft Sentinel, and other Microsoft data platforms into actionable intelligence with KQL (Kusto Query Language). Experts in information security and analysis guide you through what it takes to automate your approach to risk assessment and remediation, speeding up detection time while reducing manual work using KQL. This accessible and practical guidedesigned for a broad range of people with varying experience in KQLwill quickly make KQL second nature for information security. Solve real problems with Kusto Query Language and build your competitive advantage: Learn the fundamentals of KQLwhat it is and where it is used Examine the anatomy of a KQL query Understand why data summation and aggregation is important See examples of data summation, including count, countif, and dcount Learn the benefits of moving from raw data ingestion to a more automated approach for security operations Unlock how to write efficient and effective queries Work with advanced KQL operators, advanced data strings, and multivalued strings Explore KQL for day-to-day admin tasks, performance, and troubleshooting Use KQL across Azure, including app services and function apps Delve into defending and threat hunting using KQL Recognize indicators of compromise and anomaly detection Learn to access and contribute to hunting queries via GitHub and workbooks via Microsoft Entra ID
Über den Autor
YURI DIOGENES, MSC has a Master of Science in cybersecurity intelligence and forensics investigation from UTICA College and is currently working on his PhD in Cybersecurity Leadership from Capitol Technology University. Yuri has been working at Microsoft since 2006; currently, he is a Principal PM Manager for the Customer Experience Engineering Defender for Cloud Team, where he manages a global team of product managers focusing on cloud security posture management and workload protection. Yuri has published more than 30 books, mostly about information security and Microsoft technologies. Yuri is also a professor at EC-Council University, teaching in the Bachelor in Cybersecurity Program. Yuri has an MBA and many IT/security industry certifications, such as CISSP, MITRE ATT&CK® Cyber Threat Intelligence Certified, E|CND, E|CEH, E|CTI, E|CSA, E|CHFI, CompTIA Security+, CySA+, Network+, CASP, and CyberSec First Responder. You can follow Yuri on Twitter at [...] NICHOLAS DICOLA is a Security Jedi and the VP of Customers at Zero Networks, where he leads a global team responsible for all things customer related. He has a Master of Business Administration with a concentration in information systems and various industry certifications such as CISSP and CEH. You can follow Nicholas on Twitter at [...] KEVIN MCKINNERNEY is a senior program manager on the Microsoft Purview Data Governance Customer Experience Engineering (CxE) Team, where he provides best practices and deployment guidance to help customers quickly onboard the Microsoft Purview Data Governance solution. Kevin has been working at Microsoft since 2011 in various roles, including senior support escalation engineer on the Microsoft CSS Security team and senior premier field engineer, focusing on Microsoft security and information protection. Kevin has authored dozens of blog posts and videos related to information protection and Purview data governance and has spoken at many technical conferences, including RSAC, Microsoft Ignite, Microsoft MVP Summits, and the Microsoft Security Engineering Advisory Council. Prior to starting at Microsoft, he worked for IBM as a Microsoft support manager and spent eight years as an information systems technician while on active duty in the United States Navy. Kevin received a Bachelor of Science in business management from the University of Phoenix and holds many certifications, including CISSP and GCIH. You can follow Kevin on Twitter [...] and on GitHub [...]
Inhaltsverzeichnis
Foreword by Ann Johnson
CHAPTER 1 Introduction and Fundamentals
CHAPTER 2 Data Aggregation
CHAPTER 3 Unlocking Insights with Advanced KQL Operators
CHAPTER 4 Operational Excellence with KQL
CHAPTER 5 KQL for CybersecurityDefending and Threat Hunting
CHAPTER 6 Advanced KQL Cybersecurity Use Cases and Operators
