Microsoft KQL Cheat Sheet

SecurityEvent | where EventID == 4624

SecurityEvent | project TimeGenerated, Account, Computer

SecurityEvent | summarize count() by Account

SecurityEvent | take 10

SecurityEvent | sort by TimeGenerated desc

SecurityEvent | extend Hour = datetime_part('hour', TimeGenerated)

SecurityEvent | join (Heartbeat) on Computer

union SecurityEvent, Syslog

SecurityEvent | distinct Computer

SecurityEvent | count

SecurityEvent | where TimeGenerated > ago(1h)

SecurityEvent | where Account contains "admin"

SecurityEvent | where Computer startswith "WEB"

SecurityEvent | summarize count() by bin(TimeGenerated, 1h) | render timechart

SecurityEvent | summarize count() by bin(TimeGenerated, 1h)

Syslog | parse Message with * "user=" user:string " " *

SecurityEvent | extend IPs = split(SrcIP, '.')

Event | mv-expand Tags | where Tags == "critical"

Perf | make-series avg(CounterValue) on TimeGenerated step 5m

SecurityEvent | evaluate bag_unpack(AdditionalInfo)

let cached = materialize(SecurityEvent | where TimeGenerated > ago(1h));

range x from 1 to 10 step 1 | extend y = x * 2

datatable(Name:string, Age:int) ["John", 25, "Jane", 30]

let threshold = toscalar(Perf | summarize avg(CounterValue));

Perf | sort by TimeGenerated | extend PrevValue = prev(CounterValue)

Sales | sort by Date | extend RunningTotal = row_cumsum(Amount)