Writing a query

Now that you have seen how to use the Logs page in Microsoft Sentinel, it's time to use your new skills to write your own queries. No matter what the query is, there are a few basic steps you will take to create your query:

1. Have an idea of what information you are looking for. Do you need to know which computers are currently active? What actions a user performed in SharePoint? What data has been ingested? This will give you an idea of what log(s) you will need to look at. Look at Chapter 11, Threat Hunting in Microsoft Sentinel, for information on one way to keep track of this data.
2. Once you have an idea of which table you want to look at, the next step is to look at a small number of rows in that table to get a better understanding of the data that is stored in it.

   One of the easiest ways to do this is to find the table in the Tables pane, hover over it, and click on the See preview data link in the pop-up window. This will show up to 10 rows from...