Forum Discussion
KQL Queries in Sentinel & Defender? Different UI's...?
Microsoft
I am not sure I can bridge the gap between the two, and I understand that more conformity would make it easier to use. I can explain why the difference is there:
Kusto (the K in KQL) is a a Microsoft developed database technology targeted at big data analytics. It is widely used by Microsoft products and is also available to you directly as Azure Data Explorer. Each system using Kusto can expose it to a different level and add additional functionality. Both MDATP and Sentinel (in practice, Log Analytics) expose a lot, making it look similar, but there are differences, and not just in the UI. Some Kusto capabilities might be available in one and not the other, or in neither.
On the practical side, we would love to hear about those discrepancies, as well as your preferred solution and add to the relevant roadmap the features you liked better.
~ Ofer
Hi Ofer_Shezaf
For my 2 cents - and keeping in mind I haven't investigated Playbooks or Notebooks yet...?
It's very handy having the search to the schema right there + the Tabs feature is very simple to use and intuitive:
Sentinel_UI_1
Having the tabs work like a browser is very simple. The History section is a little hard to read...?
Instead of History being laid out like it is today - can you simply "extract" the first two lines of "comments" ( // ) and then display that in the same sized tiles (as below) - this will be easier to read + it will help encourage folks to write/add comments correctly in their queries…?
Can we also have "extensibility" to drop the samples we don't need/use - or at least put them further back - then we can have our saved examples/hunting queries can be brought in here?
Sentinel_UI_2
Not sure if Tabs works here? and it sort of looks like there is a lack of search in the Schema on the left, but possibly this is because we can seach other elements from the search areas on the right...?
The list of "suggested" queries is good and appears to be contextual?
Defender_UI_1
I hope this helps?