KQL & Sentinel Patterns

KQL query patterns I’ve actually used in Microsoft Sentinel. Every entry has a date and context.

Entries from QRadar-to-Sentinel migration, authentication log analysis, email security investigations. See Codex: KQL Reference for syntax.