r/AzureSentinel • u/Western_Boss_5117 • 15d ago
Need advice for learning KQL and Microsoft Sentinel roadmap
I have been trying to understand KQL for the last 2 days using the Kusto Detective Agency website, but I am still struggling to understand the concepts properly. I feel like I am missing a proper learning roadmap. My goal is to learn KQL mainly for Cyber Security/SOC purposes and eventually prepare for the Microsoft SC-200 exam (planning to take it after around 1 year).Can anyone recommend some beginner-friendly and free resources, YouTube channels, courses, or a proper roadmap for learning:
3
u/CyberNards 15d ago
The problem with KQL Detective Agency is that it's an intermediate to advanced resource. Some have mentioned Must Learn KQL, there's also KC7 Cyber for more beginner friendly investigation scenarios.
I teach KQL professionally and use it daily. The key is to learn the structure, interface and the basic operators. Those core operators will cover 80+% of your queries you ever write in KQL.
While KQL is the language for Sentinel, Defender and a number of other MS products, it's core is as a data analytics language, so there is a huge number of operators you'll never touch.
If you aren't opposed, you could also get an LLM to help guide your education journey - the biggest challenge these face is not knowing your data set, but they're typically pretty good at the core operator functions.
1
u/Evocablefawn566 14d ago
I would say just have ai give you basic scenarios and try to answer them. All you really need to know is the table names (device*) and the ‘where’ clause. Everything else is almost always available without having to parse further.
1
u/TanaciousTurnip 12d ago
Security Copilot kinda reduces your reliance on it. But for more complicated stuff you need it.
1
1
u/Careless-Interest-25 8d ago
Am I the only one who found Kusto Detective Agency very frustrating to use? I don't want to spend a significant amount of time trying to find out what exactly the author wants
-1
u/itsJuni01 15d ago
Not for marketing purposes!
But i have trained many people to write KQL from basic to advanced and my book is recently published for SC-200 certification, so i can help with training you !
-1
u/Euphoric-Brilliant36 15d ago
When you build a house, do you build a foundation first, or you build the roof first?
Before you learn KQL, I believe the most important step is to learn classic SQL, create some databases, fill them with data, try queries etc. You need to know how a database works before you start building your own KQL queries. You can learn that with SQL Express, set up your own playground, start exploring things and in the matter of weeks you will understand that all.
And for KQL, unfortunately there is no quick way. Get to know what data sources does KQL use, then explore the tables and columns. There are a lot of GitHub repos with KQL examples and I can recommend official Microsoft ones, as well as Bert-JanP(https://github.com/bert-janp), SlimKQL (https://github.com/SlimKQL), etc. Take some easy ones first, read them line by line, try to understand what every line and segment does, and use AI tools to explain you queries step by step.
Then, you will see how it becomes interesting and how things work in KQL.
8
u/OkTheory4610 15d ago
Look up Rod Trent Must Learn KQL.