Recon your Azure resources with Kusto Query Language (KQL)

RECON YOUR AZURE RESOURCES WITH KUSTO QUERY LANGUAGE (KQL) : ITOps is always dealing with lots of data. From monitoring data and logs to resource metadata, its not uncommon to have to sift through thousands if not millions of records at a time. There is one hidden gem of a tool in Azure that can handle a lot of this, and that’s KQL… the Kusto Query Language.

In this episode of #KnowOps, Dana introduces us to the power of the KQL and shows how to use it with things like Log Analytics, Azure Sentinel and Azure Resource Graph. He even demonstrates a simple way he uses KQL as part of his regular Azure pentest efforts to find potentially vulnerable hosts in seconds when working with clients.

--

We 💖 #azops

#azure #itops #knowops

[DanaEpp]

I 💖 KQL. Especially in Log Analytics and Azure Resource graph. How about you? How are you using KQL?

[PullUps]

Azure newbie here. This FREE vid cleared up the basics of the KQL better than any online training or study guide I've paid for.

[koolaid]

I freaking love this guy!! I love the way he explains things and isn't monotoned! This helps me soo much in passing my pass two Azure certs

[kevinpowers]

I'm doing my best to learn things that are on all the job posts I'm going for and I really appreciate the way you explain KQL. Thank you good sir. I have Liked, Subscribed and well here's my comment.

[TenMinuteKQL]

Great session, thank you for supporting the KQL and security communities!

[knj]

We use the same type of glasses. Thank you for the video. Cheers

[alaingarel]

Very good introduction to KQL. Very good overview in 15 minutes.

[minstreltokunbo]

I am screaming with joy!! I just got to know about KQL today from a video I watched on Instagram and decided to learn more. Ahhhh

[juanjogarcia]

Fantastic video ... I've been an SQL fan for years, you have discovered me a new way to investigate and enjoy through Azure Monitor and its Kusto QL, thank you ...

[glitchdigger]

Wow dude this is so great. Thanks very much for creating this video. :) Such a practical and straightforward example of both Red and Blue team capabilities here. I also really like KQL's function names and setup a lot.

[codycodes]

Great introduction! Loved the pi chart. KQL is my new go-to on Azure!

[thepassportog]

Taking a break after just missing passing AZ 104. Pleasant surprise

[khajareddy]

Thanks For Your very informative session on KQL, for next week please make an video on how to enable Log Analytics Workspace on Any Azure Resource and how to collect data in to tables

[Krishna-mdiu]

It was very informative, thanks for this video and key posting more content and KQL

[randytate]

Excellent presentation - both in content and execution. Well done.

[allanschuman]

What type of scope for connection do you need to set to be able to see and query your working database tables? I am having a hard time figuring out how to get KQL to recognize my table names.

[nandpurohit]

Fantastic ! Thank you for putting this together !

[midhunmohan]

Very Interesting, Can you please make video to list out the patticular value is true / false from axurd congratulations?

[adrien-barret]

seems cool, how do you load a table to pickup naming ? don't see option after the | for that, like select ClusterName from KubeNodeInventory ?

[taycynne]

Hi I have an question. I am trying to learn KQL however, I would need to know about the reason behind the failed nodes being rebooted... Any Suggestions on what to do? :(