Writing a query
Now that you have seen how to use the Logs page in Azure Sentinel, it's time to use your new skills to write your own queries. No matter what the query is, there are a few basic steps you will take to create your query:
- Have an idea of what information you are looking for. Do you need to know which computers are currently active? What actions a user performed in SharePoint? What data has been ingested? This will give you an idea of what log(s) you will need to look at. Look at Chapter 10, Threat Hunting in Azure Sentinel, for information on one way to keep track of this data.
- Once you have an idea of which log you want to look at, the next step is to look at a small number of rows in that log to get a better understanding of the data that is stored in the log.
One of the easiest ways to do this is to find the log in the Tables pane and click on the eye icon to the right of the name. This will create a new KQL code window that will return up to 50 rows...
