KQL Search

This document provides an overview of a session titled "The Art of Knowing Your SIEM & XDR Data," which was part of a demo for ExpertsLive Netherlands 2024. The session aims to help security professionals better understand and utilize the vast amounts of data they handle daily in security information and event management (SIEM) and extended detection and response (XDR) systems, specifically focusing on Microsoft Sentinel and Defender for XDR.

The session covers:

1. Understanding Data Tables: It explains how to identify and understand the different tables and subtypes of data available in Sentinel and Defender for XDR. This knowledge helps professionals locate specific data and evidence more efficiently.

2. Querying Data: The session provides various KQL (Kusto Query Language) queries to help professionals extract valuable insights from their data. These queries include:

   • Listing unique tables with events from the last 90 days.
   • Counting events per table.
   • Retrieving table schemas.
   • Identifying unique tables and their actions.
   • Finding the most and least active tables and sub-tables.
   • Discovering new sub-tables and actions.

3. Entity Queries: It also includes queries to find specific entities, such as IP addresses or device names, within the data tables and determine how often they appear.

The session is designed for security professionals such as Blue/Purple Teamers, Threat Hunters, Detection Engineers, Security Engineers, SOC Analysts, and Incident Responders. It emphasizes the importance of knowing the data you have and where it is located to enhance detection, incident response, and data enrichment capabilities. The queries provided support Microsoft Sentinel, Defender XDR, and Unified XDR, with some exceptions noted for Defender XDR.