You're reading from Microsoft Sentinel in Action Architect, design, implement, and operate Microsoft Sentinel as the core of your security solutions

Product type Paperback

Published in Feb 2022

Publisher Packt

ISBN-13 9781801815536

Length 478 pages

Edition 2nd Edition

Tools

Azure Functions

Concepts

Cybersecurity

Authors (2):

Richard Diver

Gary Bushey

Preface

1. Section 1: Design and Implementation

2. Chapter 1: Getting Started with Microsoft Sentinel FREE CHAPTER

3. Chapter 2: Azure Monitor – Introduction to Log Analytics

4. Section 2: Data Connectors, Management, and Queries

5. Chapter 3: Managing and Collecting Data

6. Chapter 4: Integrating Threat Intelligence with Microsoft Sentinel

7. Chapter 5: Using the Kusto Query Language (KQL)

8. Chapter 6: Microsoft Sentinel Logs and Writing Queries

9. Section 3: Security Threat Hunting

10. Chapter 7: Creating Analytic Rules

11. Chapter 8: Creating and Using Workbooks

12. Chapter 9: Incident Management

13. Chapter 10: Configuring and Using Entity Behavior

14. Chapter 11: Threat Hunting in Microsoft Sentinel

15. Section 4: Integration and Automation

16. Chapter 12: Creating Playbooks and Automation

17. Chapter 13: ServiceNow Integration for Alert and Case Management

18. Section 5: Operational Guidance

19. Chapter 14: Operational Tasks for Microsoft Sentinel

20. Chapter 15: Constant Learning and Community Contribution

21. Assessments

22. Other Books You May Enjoy

Chapter 5

You need to filter the StormEvents table by all the states that are set to California (remember the case-sensitive versus non-case-sensitive filters) and then get a count of those rows. You could cheat and look at the output of the first two lines of the code in the following snippet in Azure Data Explorer but that isn't really the best way to get the answer, which is 898:
```
StormEvents
| where State =~ "California"
| summarize count()
```
This entails looking at the StormEvents table and getting just one instance of each state. Use the distinct operator for this:
```
StormEvents
|  distinct State
```
You will need to look at the DamageProperty field in the StormEvents table and make sure that the field is greater than 10,000 and less than 15,000:
```
StormEvents
| where DamageProperty >10000 and DamageProperty <15000
```
You have three out of the four columns needed in the StormEvents table already. The fourth column, the one for the total amount of...

The rest of the chapter is locked