KQL (Kusto Query Language) Codex

Query library for Microsoft Sentinel. Organized by use case, scalable as proficiency grows.

Quick Reference

// Basic structure
TableName
| where TimeGenerated > ago(24h)
| where Column == "value"
| summarize count() by Column
| sort by count_ desc
| take 10

Sections

Planned (create as proficiency grows)

  • Endpoint — Defender XDR, process execution, lateral movement

  • Network — firewall logs, DNS, flow data, ISE syslog

  • Identity — AD changes, privilege escalation, account lockouts

  • Threat Hunting — IOC sweeps, anomaly detection, MITRE ATT&CK mapping

  • Incident Response — triage queries, timeline reconstruction, blast radius

  • Custom Tables — Monad ETL log sources, custom connectors

  • Workbooks & Analytics — dashboard queries, scheduled rules, alerts

Common Tables

Table Content

SigninLogs

Azure AD / Entra sign-in events

SecurityEvent

Windows security events (Event IDs)

SecurityAlert

Alerts from all security products

SecurityIncident

Sentinel incidents

EmailEvents

Email delivery, phishing, spam

DeviceProcessEvents

Endpoint process execution (Defender)

DeviceNetworkEvents

Endpoint network connections

CommonSecurityLog

CEF syslog (firewalls, ISE, proxies)

Syslog

Linux syslog, network devices

AzureActivity

Azure management plane activity

OfficeActivity

M365 activity (SharePoint, OneDrive, Teams)

ThreatIntelligenceIndicator

IOCs from threat feeds

Custom_CL

Custom log tables (Monad ETL output)