Chapter 6: Microsoft Sentinel Logs and Writing Queries
In the previous chapter, we looked at the Kusto Query Language (KQL) and gave a brief introduction to how to use it. In this chapter, we will learn about the Microsoft Sentinel Logs page. The Microsoft Sentinel Logs page is where you can see the various logs in your workspace, determine the type of data that makes up the logs, create the queries that will be used in the Analytics rules and threat hunting, as well as save these queries for later use. This will help you in creating rules and is an integral part of investigating incidents.
As part of this chapter, we will provide an overview of the Microsoft Sentinel Logs page, learn about the various sections, and look at how to use KQL to write queries. We will review the Logs screen in Microsoft Sentinel and show how to look at columns that make up the table, using both the UI and KQL. We will also look at the steps you can take to help develop your queries.
In a nutshell...
