skills.rest
OpenTideHQ
OpenTideHQOFFICIAL
Explore all skills by this author →
WebsiteGitHub

kusto-query-language

Provide platform-agnostic KQL patterns and optimisation rules for cross-platform queries.

4|1|Updated Apr 28, 2026
Search Tags:#best-practices#sentinel#kql#defender#hunting#kusto
One-click install
npx skills add https://github.com/OpenTideHQ/AgentTide --skill kusto-query-language
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kusto-query-language
Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/kusto-query-language
Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill kusto-query-language

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Platform-agnostic KQL guidance reduces the complexity and risk of writing cross-platform queries by providing a consistent set of patterns, examples, and anti-patterns.

Core Features & Use Cases

  • Platform-agnostic patterns for operator hierarchy, time-bound filtering, joins, and summarisation across Sentinel and Defender.
  • Best practices for writing maintainable KQL, including inline commentary and structured headers.
  • Use Case: A security analyst crafts efficient queries that work across both platforms, reducing duplication and speeding investigations.

Quick Start

Write a minimal cross-platform KQL example that demonstrates time-bounded filtering and a token-based search.

Frequently Asked Questions about kusto-query-language

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write KQL hunting queries that work across both Sentinel and Defender?▼

Cross-platform KQL patterns ensure hunting queries function consistently across Sentinel and Defender by standardizing operator hierarchy, time-bound filtering, and indexed lookups, reducing duplication and mitigating compatibility risks.

What is the best way to optimize KQL queries for detection engineering?▼

Optimizing KQL queries involves applying specific operator hierarchy rules, enforcing time-bound filtering early, and following summarisation anti-pattern guidance to improve query execution speed and overall detection quality.

Does this KQL guidance include best practices for query commenting and structure?▼

KQL best practices include adding inline commentary and structured headers to provide rationale, ensuring detection engineering queries remain maintainable and understandable for security analysts during investigations.

Why should I use time-bound filtering and safe projection in KQL?▼

Time-bound filtering and safe projection are required KQL practices that constrain data lookups to indexed fields, preventing full-table scans and ensuring robust, performant query execution across platforms.

What are common KQL anti-patterns I should avoid during threat hunting?▼

Common KQL anti-patterns to avoid include ignoring operator hierarchy, skipping time-bound filtering, and mismanaging joins or summarisation, all which degrade cross-platform query performance and reliability.

Related Skills

Explore More Data & Analytics Skills→
audibleblinkaudibleblink
4

kql-mde-xdr

Write and optimize KQL queries for MDE, Sentinel, and Defender XDR.

Community
Advanced
skinred78skinred78
1

firebase-cloudrun

Deploy Flask apps to Google Cloud Run with Firebase Hosting URLs.

Community
Advanced
Likas07Likas07

threat-detection-engineer

Develop SIEM detection rules in Sigma and map them to MITRE ATT&CK.

Community
Advanced
dstreefkerkdstreefkerk
4

kql-expert

Optimizes and validates Kusto Query Language queries for Microsoft Sentinel and Azure Monitor.

Community
Advanced