rthangaraj / mustlearnkql

Code included as part of the MustLearnKQL blog series

Must Learn KQL - the series

This repository contains the code and queries included as part of the MustLearnKQL series. The series is a continuing effort to discuss and educate about the power and simplicity of the Kusto Query Language.

There's now a book version! The book (PDF) will be updated whenever changes are made or new parts of the series are released. Get the book: https://cda.ms/3mT

Table of Contents

The following are links to the entire series so far:

* Must Learn KQL Part 1: Tools and Resources Posted November 17, 2021
* Must Learn KQL Part 2: Just Above Sea Level Posted November 18, 2021
* Must Learn KQL Part 3: Workflow Posted November 19, 2021
* Must Learn KQL Part 4: Search for Fun and Profit Posted November 22, 2021
* Must Learn KQL Part 5: Turn Search into Workflow Posted November 29, 2021
* Must Learn KQL Part 6: Interface Intimacy Posted December 2, 2021, Updated December 8, 2021
* Must Learn KQL Part 7: Schema Talk Posted December 7, 2021
* Must Learn KQL Part 8: The Where Operator Posted December 8, 2021
* Must Learn KQL Part 9: The Limit/Take Operators Posted December 13, 2021
* Must Learn KQL Part 10: The Count Operator Posted December 14, 2021
* Must Learn KQL Part 11: The Summarize Operator - due the week of January 3, 2022
* Must Learn KQL Part 12: The Render Operator
* Must Learn KQL Part 13: The Bin Operator
* Must Learn KQL Part 14: The Extend Operator
* Must Learn KQL Part 15: The Project Operator
* Must Learn KQL Part 16: The Distinct Operator
* Must Learn KQL Part 17: The Order/Sort and Top Operators
* Must Learn KQL Part 18: The Let Statement
* Must Learn KQL Part 19: The Union Operator
* Must Learn KQL Part 20: The Join Operator
* Must Learn KQL Part 21: Parsing Unruly Data
* Must Learn KQL Part 22: Building your first Microsoft Sentinel Analytics Rule
* Must Learn KQL Part 23: Repeatable Repercussion (Functions)

The series has it's own shortlink. To return back here, just remember the easy URL: https://aka.ms/MustLearnKQL