kql-writing

Document KQL best practices for Microsoft Sentinel detection queries.

15|5|Updated Apr 6, 2026

Search Tags:#queries #detection #log-analysis #sentinel #kql #security-analytics #kusto

Ready to run

npx skills add https://github.com/Liberty91LTD/cti-skills --skill kql-writing

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: kql-writing
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/kql-writing
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill kql-writing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

KQL writing guidance helps security analysts craft effective queries for Microsoft Sentinel, reducing trial-and-error and enabling faster detection development across multiple data sources.

Core Features & Use Cases

Guidance on KQL syntax, operators, and common patterns used in security analytics.
Concrete examples for Windows Event logs, Azure AD Sign-ins, Defender for Endpoint, and Defender logs to build detections and dashboards.
Use Case: write a query to identify suspicious sign-in patterns or lateral movement indicators and export results for investigation.

Quick Start

Run a sample KQL query against your data to validate syntax and refine detection logic.

Frequently Asked Questions about kql-writing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write KQL queries for Microsoft Sentinel detections?▼

To write KQL queries for Microsoft Sentinel detections, apply clean syntax, proper time constraints, and reusable patterns like let, project, and summarize to build effective analytics rules across multiple log sources.

What are the best practices for KQL syntax in security analytics?▼

KQL syntax best practices for security analytics include using proper time constraints to limit data scopes and applying reusable operators like let, project, and summarize to structure efficient detection rules.

Can I use KQL to analyze Windows Security and Azure AD logs?▼

Yes, you can use KQL to analyze Windows Security and Azure AD logs, crafting concrete detection queries to identify suspicious sign-in patterns or lateral movement indicators for security investigations.

How do I create a KQL query for Defender for Endpoint logs?▼

To create a KQL query for Defender for Endpoint logs, utilize KQL operators and common security analytics patterns to build detections and dashboards that monitor endpoint threats effectively.

What KQL patterns help identify suspicious sign-in activity?▼

KQL patterns using the summarize operator and proper time constraints help identify suspicious sign-in activity by aggregating Azure AD sign-in logs to detect anomalous user behavior patterns.