Kusto query overview

Let's talk about Kusto queries. These are read-only requests for data that you define in the query itself, so think of it as a PowerShell get cmdlet. You're simply asking to retrieve information, as defined in the query. If you're familiar with SQL, then Kusto should be easy for you to pick up as it's similar to the database, table, and column hierarchy.

First, we need to figure out a place to start. Looking at the schema, we have a handful of table descriptions that show the available tables. We have Alerts, Apps and Identities, Email, Devices, and Threat and Vulnerability Management. Let's start with DeviceEvents, which can be found under Devices, as shown in the following screenshot:

Figure 11.1 – Advanced hunting column categories

The following is a sample query that we'll break down quickly. We'll start with a table called DeviceEvents that contains all sorts of events that take place on...