Chapter 6: Azure Sentinel Logs and Writing Queries
In the previous chapter, we looked at the Kusto Query Language (KQL) and gave a brief introduction on how to use it. In this chapter, we will learn about the Azure Sentinel Logs page. The Azure Sentinel Logs page is where you can see the various logs in your workspace, determine the type of data that makes up the logs, create the queries that will be used in the Log Analytics rules and threat hunting, as well as being able to save these queries for later use. This will help you in creating rules and is an integral part of investigating incidents.
As part of this chapter, we will provide an overview of the Azure Sentinel Logs page, learn about the various sections, and look at how to use KQL to write queries. We will review the Logs screen in Azure Sentinel and how to look at logs' columns using both the UI and KQL. We will also look at the steps you can take to help develop your queries.
In a nutshell, the following topics...
