← Back to courses
Cybersecurity
KQL for Threat Hunting
One week of asking security logs the right questions
A one-week classroom course on the threat hunting skill area of Microsoft's SC-200 outline: identifying the right table, writing Kusto Query Language queries, building advanced hunting queries and interpreting what they return. It covers one skill area of three and prepares for no exam on its own.
5Modules
IntermediateLevel
1 weekDuration
COURSE THUMBNAIL
What you will be able to do
Find the table that holds the evidence you need
Write KQL to filter, summarise and join
Turn a suspicion into a hunting query
Course outline
01
Tables: finding where the evidence is
02
Filtering and projecting
03
Summarising and counting
04
Joining tables
05
Building and saving a hunting query
Tools you will use
KQLMicrosoft SentinelMicrosoft Defender XDR
What you need
Basic security knowledge; SQL experience helps
