Chapter 6: Azure Sentinel Logs and Writing Queries
In the previous chapter, we looked at the Kusto Query Language (KQL) and gave a brief introduction on how to use it. In this chapter, we will learn about the Azure Sentinel Logs page. The Azure Sentinel Logs page is where you can see the various logs in your workspace, determine the type of data that makes up the logs, create the queries that will be used in the Log Analytics rules and threat hunting, as well as being able to save these queries for later use. This will help you in creating rules and is an integral part of investigating incidents.
As part of this chapter, we will provide an overview of the Azure Sentinel Logs page, learn about the various sections, and look at how to use KQL ...
Get Learn Azure Sentinel now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
