Must Learn KQL Part 6: Interface Intimacy – Azure Cloud & AI Domain Blog (azurecloudai.blog)
I preface this post by saying this: everything discussed in this post about the User Interface (UI) can be done (and should be done, eventually) in the KQL query itself.
When you’re just starting with KQL, the UI can be a blessing. As you get further in your learning and comfortability with the query language, it can be a crutch – particularly when you need to find something quickly because of a perceived security threat and view it in a way that’s most meaningful. Still, understanding the UI’s capabilities is important.