Kusto Query Language (KQL)

Concept

The query language used in Microsoft Sentinel, Defender and Azure Monitor to analyse log data.

Description

Kusto Query Language (KQL) is the query language used in Microsoft Sentinel, Microsoft Defender and Azure Monitor to analyze log data. With it, analysts filter, aggregate and join large volumes of events to find patterns, investigate incidents and build alerts or dashboards. It is a language for reading and analyzing data, not for changing it.

KQL was developed by Microsoft and is related to Microsoft Defender, where it is used for advanced hunting across security data. The same language appears in monitoring and SIEM scenarios, which makes it a shared skill for security analysts and cloud administrators who work with logs from different services.

The episodes assigned to this concept are about the platforms where KQL is used, not about the language syntax. "Microsoft Sentinel - Simply Explained" describes Sentinel as a cloud-native SIEM and SOAR platform that collects security data across the IT environment to detect, investigate and respond to threats. "Azure Monitor — Simply Explained" covers the monitoring and observability platform that collects metrics, logs, traces and events. "Azure Functions - Simply Explained" explains serverless compute that runs code when an event occurs.

Overview compiled with AI from M365.FM episodes and the facts on this page. You can improve it with the edit button below.

Glossary

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-10-31