The Must Learn KQL series has reached its completion, but that doesn’t mean it’s over. In March, I’ll kick off the next step in KQL learning in an advanced series called Addicted to KQL. For those just catching on, the Must Learn KQL series has educated close to 5,000 people since it started in November 2021. It is in process to be adopted by the Microsoft Sentinel docs platform, and I’m working to develop an official Microsoft Learn module for it. So, stay tuned for more.
Must Learn KQL is a starter series, developed to take a methodical, logical approach to learning the query language. Must Learn KQL was designed not to scare anyone but come to the realization how powerful and necessary it is, while also maintaining how simple it is to learn. It’s delivered in manageable chunks so you can spend 15 minutes of your lunch break, if you want, and consume more than just a ham sandwich.