What problem does it solve? New cybersecurity learners struggle to get hands-on practice with KQL, the query language used across Microsoft Sentinel, Defender XDR, and Azure Monitor, because setting up a data environment is a barrier. This Skill guides a learner through writing their first 8-10 real KQL queries against Microsoft's free, world-readable Log Analytics demo workspace with zero setup. ## Core Features & Use Cases - Guided five-phase curriculum: Progresses from counting rows, through where/project filtering, summarize/bin aggregation, and join, to writing three security queries from scratch. - Security-relevant practice: Every query answers a real analyst question, such as finding accounts with both failed and successful logons or hosts with the most unique users. - Concept coaching with guardrails: Each phase names concepts out loud, lists common gotchas (e.g., == vs =, case sensitivity, bin time units), and includes after-action reflection prompts. - Use Case: A career-switching learner in a cybersecurity operations program opens the demo workspace and, within about 60 minutes, writes queries that filter Windows SecurityEvent logs, aggregate failed logons by hour, and render a timechart. ## Quick Start Ask the mentor to start the cso-kql-foundations project and walk you through writing your first KQL queries in the Log Analytics demo workspace.
