The Definitive Guide to KQL: Using Kusto Query Language for operations, defending, and threat hunting

Learning KQL is essential for system administrators, Azure operators, and security analysts to ensure workloads are monitored, accessible, and secure in the Microsoft Azure cloud platform. KQL is a powerful query language with inbuilt operators and functions that can analyze data to find trends, patterns, anomalies, create forecasting, and machine learning. It is used in various Microsoft cloud products and can be operationalized in an environment.

Format: Paperback / softback
Length: 480 pages
Publication date: 04 June 2024
Publisher: Pearson Education (US)

Learning KQL is essential for system administrators, Azure operators, and security analysts working with the Microsoft Azure cloud platform. KQL is a powerful query language that enables users to analyze large volumes of structured, semi-structured, and unstructured data. It offers inbuilt operators and functions for trend analysis, pattern recognition, anomaly detection, forecasting, and machine learning. KQL is supported by various Microsoft cloud products, including Microsoft Sentinel, Azure Data Explorer, Microsoft 365 Advanced Hunting, Azure Resource Graph, Azure Monitor, and more. This book aims to be the definitive guide to learning KQL and its practical applications in solving real-world problems. As you progress through the book, you will learn how to use KQL to enhance daily operations and conduct security investigations. By the end of the book, you will not only have mastered the language but also integrated KQL into your environment. This topic is crucial for anyone responsible for managing resources in Azure and any service managed through an Azure-based security platform, as well as system administrators, security consultants, security operations center analysts, and data scientists.

Weight: 862g
Dimension: 233 x 189 x 32 (mm)
ISBN-13: 9780138293383