Starting KQL

I have always liked to twiddle with computers and dig around in files. It’s time for me to do a career pivot, so I’m teaching myself what computer concepts I can to prepare for further education and a future career.

I have to start somewhere, so I have decided to learn KQL. Last week, I started the free curriculum at kc7cyber.com. As of this writing, I have finished 5 modules of 44. I’m not going to go into what everything means just yet, but so far I have learned:

The 9 basic tables that map out an enterprise network.

Core operators like ==, contains, !contains, has, take, distinct, and count.

How to use the let command to define variables.

How to take notes and comment inside the Azure Data Explorer (ADX) interface.

Enter fullscreen mode Exit fullscreen mode

From what I can tell, it’s not super different from using filters in Excel, you can just get more specific in what you’re looking for.