#kusto — Public Fediverse posts

*Read it like an infomercial*

Are you tired of working with logs that contain arrays with multiple JSON like this?

Have you tried creating a new column with the value you want only to find out that this value has no fixed position in the array?

Now your problems are over! With this 5 line KQL snippet, written by a real human, you can finally have the peace of mind that all the fields are populated correctly and everything is neat inside a single JSON!

https://github.com/0x-cde/Threat-Hunting-with-KQL/blob/main/CodeSnippets/Converting-array-of-json-to-single-json.md

#kusto #kustoquery #kql #threathunting #threat_hunting #dfir #digitalforensics

*Read it like an infomercial*

Are you tired of working with logs that contain arrays with multiple JSON like this?

Have you tried creating a new column with the value you want only to find out that this value has no fixed position in the array?

Now your problems are over! With this 5 line KQL snippet, written by a real human, you can finally have the peace of mind that all the fields are populated correctly and everything is neat inside a single JSON!

https://github.com/0x-cde/Threat-Hunting-with-KQL/blob/main/CodeSnippets/Converting-array-of-json-to-single-json.md

#kusto #kustoquery #kql #threathunting #threat_hunting #dfir #digitalforensics

*Read it like an infomercial*

Are you tired of working with logs that contain arrays with multiple JSON like this?

Have you tried creating a new column with the value you want only to find out that this value has no fixed position in the array?

Now your problems are over! With this 5 line KQL snippet, written by a real human, you can finally have the peace of mind that all the fields are populated correctly and everything is neat inside a single JSON!

https://github.com/0x-cde/Threat-Hunting-with-KQL/blob/main/CodeSnippets/Converting-array-of-json-to-single-json.md

#kusto #kustoquery #kql #threathunting #threat_hunting #dfir #digitalforensics

*Read it like an infomercial*

Are you tired of working with logs that contain arrays with multiple JSON like this?

Have you tried creating a new column with the value you want only to find out that this value has no fixed position in the array?

Now your problems are over! With this 5 line KQL snippet, written by a real human, you can finally have the peace of mind that all the fields are populated correctly and everything is neat inside a single JSON!

https://github.com/0x-cde/Threat-Hunting-with-KQL/blob/main/CodeSnippets/Converting-array-of-json-to-single-json.md

#kusto #kustoquery #kql #threathunting #threat_hunting #dfir #digitalforensics

*Read it like an infomercial*

Are you tired of working with logs that contain arrays with multiple JSON like this?

Have you tried creating a new column with the value you want only to find out that this value has no fixed position in the array?

Now your problems are over! With this 5 line KQL snippet, written by a real human, you can finally have the peace of mind that all the fields are populated correctly and everything is neat inside a single JSON!

https://github.com/0x-cde/Threat-Hunting-with-KQL/blob/main/CodeSnippets/Converting-array-of-json-to-single-json.md

#kusto #kustoquery #kql #threathunting #threat_hunting #dfir #digitalforensics

Blog alert!

This time, a way to handle arrays that only have one element in KQL. A follow-up to the previous blog on XML and JSON.

#MicrosoftFabric
#ADX
#Kusto
#KQL
#JSON
#XML
#DataEngineer

http://sqlreitse.com/2026/03/17/microsoft-realtime-intelligence-the-array-that-wasnt/

Blog alert!

This time, a way to handle arrays that only have one element in KQL. A follow-up to the previous blog on XML and JSON.

#MicrosoftFabric
#ADX
#Kusto
#KQL
#JSON
#XML
#DataEngineer

http://sqlreitse.com/2026/03/17/microsoft-realtime-intelligence-the-array-that-wasnt/

Blog alert!

This time, a way to handle arrays that only have one element in KQL. A follow-up to the previous blog on XML and JSON.

#MicrosoftFabric
#ADX
#Kusto
#KQL
#JSON
#XML
#DataEngineer

http://sqlreitse.com/2026/03/17/microsoft-realtime-intelligence-the-array-that-wasnt/

Blog alert!

This time, a way to handle arrays that only have one element in KQL. A follow-up to the previous blog on XML and JSON.

#MicrosoftFabric
#ADX
#Kusto
#KQL
#JSON
#XML
#DataEngineer

http://sqlreitse.com/2026/03/17/microsoft-realtime-intelligence-the-array-that-wasnt/

Blog alert!

A short one this time, on a nice find processen XML data in Realtime Intelligence.

#MicrosoftFabric
#RealtimeIntelligence
#XML
#Kusto
#KQL
#EventHouse

http://sqlreitse.com/2026/03/14/microsoft-fabric-realtime-intelligence-processing-xml-or-are-you/

The latest season of #kusto detective agency starts today! https://detective.kusto.io/register

Let AI Catch the Bugs: Uncoder AI Validates Detection Rule Syntax and Logic – Source: socprime.com https://ciso2ciso.com/let-ai-catch-the-bugs-uncoder-ai-validates-detection-rule-syntax-and-logic-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #SOCPrimePlatform #socprimecom #socprime #Splunk #Kusto #Blog #SPL

From IOCs to Queries: How Uncoder AI Automates Threat Intelligence Action – Source: socprime.com https://ciso2ciso.com/from-iocs-to-queries-how-uncoder-ai-automates-threat-intelligence-action-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #MicrosoftSentinel #SOCPrimePlatform #socprimecom #socprime #Elastic #Splunk #Kusto #Blog #STIX #IOC

From IOCs to Queries: How Uncoder AI Automates Threat Intelligence Action – Source: socprime.com https://ciso2ciso.com/from-iocs-to-queries-how-uncoder-ai-automates-threat-intelligence-action-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #MicrosoftSentinel #SOCPrimePlatform #socprimecom #socprime #Elastic #Splunk #Kusto #Blog #STIX #IOC

From IOCs to Queries: How Uncoder AI Automates Threat Intelligence Action – Source: socprime.com https://ciso2ciso.com/from-iocs-to-queries-how-uncoder-ai-automates-threat-intelligence-action-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #MicrosoftSentinel #SOCPrimePlatform #socprimecom #socprime #Elastic #Splunk #Kusto #Blog #STIX #IOC

From IOCs to Queries: How Uncoder AI Automates Threat Intelligence Action – Source: socprime.com https://ciso2ciso.com/from-iocs-to-queries-how-uncoder-ai-automates-threat-intelligence-action-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #MicrosoftSentinel #SOCPrimePlatform #socprimecom #socprime #Elastic #Splunk #Kusto #Blog #STIX #IOC

From Threat Report to Detection Logic: Uncoder AI Automates Rule Generation – Source: socprime.com https://ciso2ciso.com/from-threat-report-to-detection-logic-uncoder-ai-automates-rule-generation-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #MicrosoftSentinel #SOCPrimePlatform #socprimecom #socprime #Kusto #Blog

How Full Summary in Uncoder AI Supercharges Kusto Query Analysis for Threat Hunters – Source: socprime.com https://ciso2ciso.com/how-full-summary-in-uncoder-ai-supercharges-kusto-query-analysis-for-threat-hunters-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #MicrosoftSentinel #SOCPrimePlatform #SysmonEventID7 #FullSummary #socprimecom #clfs.sys #socprime #Kusto #Blog

🐣 HAPPY EASTER CAPSTONE! 🛡️

My KQL courses now include a complete attack scenario to test your skills — end to end.

🎯 Hands-on labs
📉 20% OFF for a limited time!
Crack it open 👇

#KQL #Kusto #ThreatHunting #DetectionEngineering #DFIR

https://academy.bluraven.io

🎁 NEW UPDATE:

I've added a small challenge to my FREE "Hands-On Introduction to KQL for Security Analysis" course.

More will be coming soon!

#KQL #Kusto #MicrosoftDefender #MicrosoftSentinel
👇
https://academy.bluraven.io/course/introduction-to-kql-for-security-analysis

🚨 FREE unlimited lab access to "Introduction to KQL for Security Analysis" course!

Thrilled to announce that my Intro to KQL for Security Analysis lab environment is now completely free with no time restrictions!

https://academy.bluraven.io/course/introduction-to-kql-for-security-analysis

#KQL #Kusto #ThreatHunting #Infosec

🎁 Mega savings are here!

👉 https://academy.bluraven.io/blackfriday2024

#KQL #Kusto #BlackFriday

Get ready for Black Friday

See what's coming 👇

https://academy.bluraven.io/blackfriday2024-coming

#Kusto #KQL

KQL

Kusto Query Language (KQL) is a powerful query language that is used to query Azure Data Explorer (ADX) and Azure Monitor log data. KQL is used to query data in tables, summarize d(...)

#adx #anomalydetection #azure #kql #kusto

https://taoofmac.com/space/dev/kql

🔍 Advanced Time Series Anomaly Detection: Discover methods you’ve never seen before.
🔗 Attack Path & Execution Chain Detection with Process Mining: A novel approach to threat detection.
🌐 Attack Pattern Detection Using Graph Semantics: Start thinking in graphs and revolutionize your detection and investigation skills.

https://academy.bluraven.io/advanced-hands-on-kql-for-threat-hunting-and-detection-engineering

#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #MicrosoftDefenderXDR #Defender #cybersecurity #KQLForSecurityAnalysts #ThreatHunting #DetectionEngineering #training #dfir #incidentresponse

🔍 Advanced Time Series Anomaly Detection: Discover methods you’ve never seen before.
🔗 Attack Path & Execution Chain Detection with Process Mining: A novel approach to threat detection.
🌐 Attack Pattern Detection Using Graph Semantics: Start thinking in graphs and revolutionize your detection and investigation skills.

https://academy.bluraven.io/advanced-hands-on-kql-for-threat-hunting-and-detection-engineering

#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #MicrosoftDefenderXDR #Defender #cybersecurity #KQLForSecurityAnalysts #ThreatHunting #DetectionEngineering #training #dfir #incidentresponse

🔍 Advanced Time Series Anomaly Detection: Discover methods you’ve never seen before.
🔗 Attack Path & Execution Chain Detection with Process Mining: A novel approach to threat detection.
🌐 Attack Pattern Detection Using Graph Semantics: Start thinking in graphs and revolutionize your detection and investigation skills.

https://academy.bluraven.io/advanced-hands-on-kql-for-threat-hunting-and-detection-engineering

#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #MicrosoftDefenderXDR #Defender #cybersecurity #KQLForSecurityAnalysts #ThreatHunting #DetectionEngineering #training #dfir #incidentresponse

🔍 Advanced Time Series Anomaly Detection: Discover methods you’ve never seen before.
🔗 Attack Path & Execution Chain Detection with Process Mining: A novel approach to threat detection.
🌐 Attack Pattern Detection Using Graph Semantics: Start thinking in graphs and revolutionize your detection and investigation skills.

https://academy.bluraven.io/advanced-hands-on-kql-for-threat-hunting-and-detection-engineering

#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #MicrosoftDefenderXDR #Defender #cybersecurity #KQLForSecurityAnalysts #ThreatHunting #DetectionEngineering #training #dfir #incidentresponse

🔍 Advanced Time Series Anomaly Detection: Discover methods you’ve never seen before.
🔗 Attack Path & Execution Chain Detection with Process Mining: A novel approach to threat detection.
🌐 Attack Pattern Detection Using Graph Semantics: Start thinking in graphs and revolutionize your detection and investigation skills.

https://academy.bluraven.io/advanced-hands-on-kql-for-threat-hunting-and-detection-engineering

#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #MicrosoftDefenderXDR #Defender #cybersecurity #KQLForSecurityAnalysts #ThreatHunting #DetectionEngineering #training #dfir #incidentresponse

Self-Hosting Kusto

This is going to be an unusual one, partly because it is about a Microsoft thing (which I typically avoid) and because it’s going to be a bit of a brain dump.(...)

#adx #ai #azure #docker #jupyter #kql #kusto #ml #parquet #polars

https://taoofmac.com/space/blog/2024/06/28/2100

🚀 FREE Hands-On KQL for Security Analysis Course is now available! 🚀
✅ 50 seats bi-monthly
✅ Certificate of completion
✅ 14-day lab with real-world Microsoft Sentinel and Defender XDR logs 🔥🔥
Enroll for #FREE 👇
https://academy.bluraven.io/intro-to-kql-for-security-analysis
#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #Defender #cybersecurity #KQLForSecurityAnalysts #training

🚀 FREE Hands-On KQL for Security Analysis Course is now available! 🚀
✅ 50 seats bi-monthly
✅ Certificate of completion
✅ 14-day lab with real-world Microsoft Sentinel and Defender XDR logs 🔥🔥
Enroll for #FREE 👇
https://academy.bluraven.io/intro-to-kql-for-security-analysis
#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #Defender #cybersecurity #KQLForSecurityAnalysts #training

🚀 FREE Hands-On KQL for Security Analysis Course is now available! 🚀
✅ 50 seats bi-monthly
✅ Certificate of completion
✅ 14-day lab with real-world Microsoft Sentinel and Defender XDR logs 🔥🔥
Enroll for #FREE 👇
https://academy.bluraven.io/intro-to-kql-for-security-analysis
#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #Defender #cybersecurity #KQLForSecurityAnalysts #training

🚀 FREE Hands-On KQL for Security Analysis Course is now available! 🚀
✅ 50 seats bi-monthly
✅ Certificate of completion
✅ 14-day lab with real-world Microsoft Sentinel and Defender XDR logs 🔥🔥
Enroll for #FREE 👇
https://academy.bluraven.io/intro-to-kql-for-security-analysis
#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #Defender #cybersecurity #KQLForSecurityAnalysts #training

🚀 FREE Hands-On KQL for Security Analysis Course is now available! 🚀
✅ 50 seats bi-monthly
✅ Certificate of completion
✅ 14-day lab with real-world Microsoft Sentinel and Defender XDR logs 🔥🔥
Enroll for #FREE 👇
https://academy.bluraven.io/intro-to-kql-for-security-analysis
#KQL #Kusto #SIEM #MicrosoftSentinel #MicrosoftDefender #Defender #cybersecurity #KQLForSecurityAnalysts #training

🚀 I just started offering Subscription plan for "Hands-On Kusto Query Language (KQL) for Security Analysts" course!
👉 https://academy.bluraven.io/hands-on-kusto-query-language-kql-for-security-analysts

#KQL #Kusto #SIEM #MicrosoftSentinel #cybersecurity #training

Have just discovered why some KQL in Defender has been erroring and I am in disbelief.

You cannot have a line break between a let statement and the next line of code!

e.g.
let myName=“TJ”;

|EmailEvents
| where …

will cause a “No Tabular expression statement found” error. removing that linebreak between let and |EmailEvents fixes the issues.

KQL is weird :)

#KQL #Defender #m365defender #cybersecurity #kusto

Come join us at DFWSMUG winter meeting for sessions on #AI, #Azure Arc, #Kusto and a lot more. Oh, and cookies too.

https://www.eventbrite.com/e/dfwsmug-winter-event-tickets-747662126547

Adversary-in-The-Middle & Business Email Compromisedthreat hunting with KQL

Find out essential points for threat hunting, focusing on how to track "potential" AiTM/BEC activities using Kusto Query Language (KQL) in Microsoft 365 Defender

https://techcommunity.microsoft.com/t5/azure-data-explorer-blog/aitm-amp-bec-threat-hunting-with-kql/ba-p/3885166

#bec #AiTM #hunting #m365defender #microsoft365defender #threathunting #microsoft #azure #soc #phishing #kql #kusto #cloudsecurity

You can use `explain` to translate #SQL to #KQL #Kusto.

SQL forever! :)

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/sqlcheatsheet

Ask for help:

Hello everyone, does anyone have the idea if it effects the performance when using a let statement to separate a join chain?

https://stackoverflow.com/questions/76849083/does-a-let-statement-breaking-a-join-chain-affects-the-performance-of-kusto-on-q

#Kusto #KQL #Performance #Azure

What’s New in Kusto – Build 2023 ! https://rodtrent.com/k60

#MustLearnKQL #KQL #Kusto #MSBuild

New post: "Cross-Platform Compatibility Made Easy with Multi-Platform Docker Images: Azure Data Explorer Sink Connector & Kafka Connect"

Docker has revolutionized the way we package and deploy software applications.

However, it's challenging to maintain a single image that can work across multiple platforms.

This blog post explores the steps required to build and deploy multi-platform Docker images.

https://nielsberglund.com/post/2023-04-17-cross-platform-compatibility-made-easy-with-multi-platform-docker-images-azure-data-explorer-sink-connector--kafka-connect/

#kafka #azuredataexplorer #kusto #kafkaconnect

New post: "Develop a Real-Time Leaderboard Using Kafka and Azure Data Explorer - II"

This is the third post about using Kafka and @azuredataexplorer (ADX) to develop a real-time leaderboard for online gaming.

In this post, you will see more about ingesting data into ADX and some "cool stuff" related to that. Specifically, what to do if you need to update/transform the data you ingest.

https://nielsberglund.com/post/2023-04-03-develop-a-real-time-leaderboard-using-kafka-and-azure-data-explorer---ii/

#kafka #azuredataexplorer #kql #kusto

🚨 Attention all #Azure enthusiasts! 🚨 Want to learn how to easily retrieve available IP addresses in your Azure Virtual network and subnets using #AzureResourceGraph? Check out my latest blog post now!

https://stefanstranger.github.io/2023/03/29/AzureResourceGraphAvailableIPAddresses/

#kusto

I just wrote one of the most complicated #kusto queries I've written until now, retrieving the total number of available IP addresses for Azure Virtual Networks and subnets. 🎉🎉

Anyone interested in me sharing this #Azure Resource Graph Kusto query?

New post: "Interesting Stuff - Week 11, 2023".

This week:

* Learn all about @azuredataexplorer and #Kusto, thanks to Akshay Dixit.
* I finally finished the second post in the Leaderboard, Kafka, and ADX series
* ChatGPT and dialogue prompting. Very interesting
* An old colleague of mine -Ted Neward - ponders the impact of AI on developers.
* Where has all the Big Data gone?

Read all about it:

https://nielsberglund.com/post/2023-03-19-interesting-stuff---week-11-2023/

#AzureDataExplorer #KQL #kafka #kafkaconnect #AI #ml #openai

Data Analysis in @azuredataexplorer using #KQL

In this learning path, you will learn through 6 training modules, how to analyze data in #AzureDataExplorer (#ADX) using the #Kusto Query Language (#KQL).

https://learn.microsoft.com/en-us/training/paths/data-analysis-data-explorer-kusto-query-language/

(Reshared from another site 😀)

Right semi join in @AzDataExplorer
#365daysofADX Day52

Right semi-join returns all records from the right side that match a record from the left side. Only columns from the right side are returned.

Try: https://lnkd.in/dze9kFTe
More: https://lnkd.in/dBznzFTy

#Kusto #KQL #ADX

Left Semi join in @AzDataExplorer
#365daysofADX Day51

Left semi-join returns all records from the left side that match a record from the right side. Only columns from the left side are returned.

Try: https://lnkd.in/dKNy6VKd
Learn More: https://lnkd.in/dJrmh-DV

#Kusto #KQL #ADX