Microsoft Sentinel in Action - Second Edition

Chapter 6: Microsoft Sentinel Logs and Writing Queries

In the previous chapter, we looked at the Kusto Query Language (KQL) and gave a brief introduction to how to use it. In this chapter, we will learn about the Microsoft Sentinel Logs page. The Microsoft Sentinel Logs page is where you can see the various logs in your workspace, determine the type of data that makes up the logs, create the queries that will be used in the Analytics rules and threat hunting, as well as save these queries for later use. This will help you in creating rules and is an integral part of investigating incidents.

As part of this chapter, we will provide an overview of the Microsoft Sentinel Logs page, learn about the various sections, and look at how to use KQL to ...