Forum Discussion

j0ebeer's avatar
j0ebeer
Copper Contributor
Jun 16, 2021

Translate Splunk query to Sentinel

Is there a good source/site to translate Splunk queries into Kusto/Sentinel?  I've managed to get the first part but it's the second part that is the challenge.  This is what I'm looking to translate...
pemontto's avatar
pemontto
Brass Contributor
Jun 21, 2021

j0ebeer this specific example translate trivially. Here's a modified version for the CommonSecurityLog table:

 

CommonSecurityLog
| summarize ["#Src"] = dcount(SourceIP), ["#Ports"] = dcount(DestinationPort) by DestinationIP
| order by ['#Src'], ['#Ports'] desc

 

Resources