This helps protect our community. Learn more

Azure Sentinel webinar: KQL part 3 of 3 - Optimizing Azure Sentinel KQL queries performance

33.6K subscribers

8.2K views 4 years ago #MicrosoftSentinel

#MicrosoftSentinel To ensure you hear about future Microsoft Sentinel webinars and other developments, make sure you join our community by going to https://aka.ms/SecurityCommunity Deck shared during the webinar can be accessed on https://aka.ms/SecurityWebinars below the recordings section.

...more

Azure Sentinel webinar: KQL part 3 of 3 - Optimizing Azure Sentinel KQL queries performance

73Likes

8,270Views

2020Sep 9

Everything starts with time

19:30

Filter fast: The less data for the next step, the better

21:07

The geolocation query

36:27

Reduce the field count using project

40:04

Transcript

Follow along using the transcript.

Microsoft Security Community

33.6K subscribers

Azure Sentinel webinar: KQL part 3 of 3 - Optimizing Azure Sentinel KQL queries performance

Key moments View all

Everything starts with time

Everything starts with time

Everything starts with time

Filter fast: The less data for the next step, the better

Filter fast: The less data for the next step, the better

Filter fast: The less data for the next step, the better

The geolocation query

The geolocation query

The geolocation query

Reduce the field count using project

Reduce the field count using project

Reduce the field count using project

Sentinel stored parsers

Sentinel stored parsers

Sentinel stored parsers

Introducing parameter function parsers

Introducing parameter function parsers

Introducing parameter function parsers

Checklist

Checklist

Checklist

Microsoft Security Community

Azure Sentinel webinar: KQL part 3 of 3 - Optimizing Azure Sentinel KQL queries performance

Comments

Key moments

Everything starts with time

Everything starts with time

Everything starts with time

Filter fast: The less data for the next step, the better

Filter fast: The less data for the next step, the better

Filter fast: The less data for the next step, the better

The geolocation query

The geolocation query

The geolocation query

Reduce the field count using project

Reduce the field count using project

Reduce the field count using project

Sentinel stored parsers

Sentinel stored parsers

Sentinel stored parsers

Introducing parameter function parsers

Introducing parameter function parsers

Introducing parameter function parsers

Checklist

Checklist

Checklist

Description

Key moments View all

Everything starts with time

Everything starts with time

Everything starts with time

Filter fast: The less data for the next step, the better

Filter fast: The less data for the next step, the better

Filter fast: The less data for the next step, the better

The geolocation query

The geolocation query

The geolocation query

Reduce the field count using project

Reduce the field count using project

Reduce the field count using project

Microsoft Security Community

Transcript

M365 Defender (MTP) webinar: Tracking the Adversary E4 Let’s hunt! Applying KQL to incident tracking

Azure Sentinel Webinar: The Information Model: Understanding Normalization in Azure Sentinel

AZ-104 Administrator Associate Study Cram v2

KQL Tutorial Series | Straight Basics | EP1

Azure Sentinel webinar: Unleash the automation Jedi tricks & build Logic Apps Playbooks like a Boss

Upbeat Lofi - Deep Focus & Energy for Work [R&B, Neo Soul, Lofi Hiphop]

Forest Cafe Jazz Music | Morning Tranquill Jazz With Nature Therapy For Stress Relief, Study & Wo...

Cybersecurity Architecture: Who Are You? Identity and Access Management

M365 Defender (MTP) webinar: Tracking the Adversary E2: Joins

Azure Sentinel webinar: Deep Dive on Threat Intelligence

Architecting SecOps for Success: Best Practices for Deploying Azure Sentinel Part 1

Kusto Query Language (KQL) Overview

Battery 2030+ Excellence Seminar How Semantic Technology Accelerates Battery Research, Simon Clark

Azure Defender, Azure Sentinel, and M365 Defender - Better Together Webinar

Microsoft Defender for Endpoint (MDATP) webinar: End-to-end security for your endpoints

Azure Sentinel webinar: Cloud & On-Premises architecture

Key moments

Key moments