| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | KQL for Data and Security Professionals — Post-Event Resources | |||||||||||||||||||||||||
2 | Session 5, closing session of the Microsoft Fabric Location Intelligence & Security User Group Data Days series | |||||||||||||||||||||||||
3 | ||||||||||||||||||||||||||
4 | Session Overview | |||||||||||||||||||||||||
5 | Host | Microsoft Fabric Location Intelligence & Security User Group | ||||||||||||||||||||||||
6 | Date | Tuesday, August 4, 2026 | ||||||||||||||||||||||||
7 | Time | 7:30–9:00 AM PT | 10:30 AM–12:00 PM ET | 2:30–4:00 PM GMT | 3:30–4:30 PM WAT | 8:00–9:30 PM IST | ||||||||||||||||||||||||
8 | Format | YouTube Livestream, full replay available | ||||||||||||||||||||||||
9 | Event / Registration Page | https://luma.com/vowwag8m | ||||||||||||||||||||||||
10 | Fabric Portal (sign in) | https://app.fabric.microsoft.com | ||||||||||||||||||||||||
11 | Fabric Getting Started | https://www.microsoft.com/en-us/microsoft-fabric/getting-started | ||||||||||||||||||||||||
12 | ||||||||||||||||||||||||||
13 | What This Session Covered | |||||||||||||||||||||||||
14 | KQL is the query language of Microsoft Sentinel, Microsoft Defender, Microsoft Fabric Real-Time Intelligence, and Eventhouse, and it is quickly becoming a shared language across data engineering, security operations, and AI workloads. This session was built for both communities: data professionals learned how KQL extends what they already know, and security professionals saw how KQL scales beyond threat hunting into operational analytics and business intelligence. | |||||||||||||||||||||||||
15 | ||||||||||||||||||||||||||
16 | ||||||||||||||||||||||||||
17 | ||||||||||||||||||||||||||
18 | ||||||||||||||||||||||||||
19 | Topics Covered | |||||||||||||||||||||||||
20 | • KQL Foundations: syntax, philosophy, core operators (where, summarize, extend, project, join, render), and Copilot-assisted query writing | |||||||||||||||||||||||||
21 | • KQL in Fabric Real-Time Intelligence: Eventhouse, ingestion via Eventstreams, Real-Time Dashboards, Eventhouse remote MCP for AI agents, business events, and workspace monitoring | |||||||||||||||||||||||||
22 | • KQL for Security Professionals: Sentinel hunting and detection rules, Defender advanced hunting, common patterns (login anomalies, privilege escalation, lateral movement, data exfiltration), and Entra ID identity correlation | |||||||||||||||||||||||||
23 | • KQL for Data Professionals: geospatial and location signals as KQL inputs, joining security logs with business data, and Eventhouse as the connective layer between security and OneLake business data | |||||||||||||||||||||||||
24 | • Quick demo project ideas to try yourself: a foundational Eventhouse query, a security hunting query (login anomalies, privilege escalation), and a business analytics query built with Copilot, all runnable in the free practice environments below | |||||||||||||||||||||||||
25 | ||||||||||||||||||||||||||
26 | Data Days Series Arc | |||||||||||||||||||||||||
27 | • Jun 23 — Location Intelligence with Maps and GeoAnalytics in Microsoft Fabric | |||||||||||||||||||||||||
28 | • Jun 30 — Get to Know Esri: From Living Atlas to Spatial Analysis for Fabric Users | |||||||||||||||||||||||||
29 | • Jul 7 — Data and AI Security and Governance in Microsoft Fabric | |||||||||||||||||||||||||
30 | • Jul 21 — Fabric IQ for Data Professionals | |||||||||||||||||||||||||
31 | • Aug 4 — KQL for Data and Security Professionals (Closing Session) | |||||||||||||||||||||||||
32 | ||||||||||||||||||||||||||
33 | ||||||||||||||||||||||||||
34 | KQL Learning & Reference | |||||||||||||||||||||||||
35 | Resource | Best For | Link | |||||||||||||||||||||||
36 | KQL quick reference (Microsoft Learn) | Operator-by-operator syntax lookup | https://learn.microsoft.com/en-us/kusto/query/kql-quick-reference?view=microsoft-fabric | |||||||||||||||||||||||
37 | SQL to KQL cheat sheet (Microsoft Learn) | SQL-background learners translating syntax | https://learn.microsoft.com/en-us/kusto/query/sql-cheat-sheet?view=microsoft-fabric | |||||||||||||||||||||||
38 | Kusto Query Language overview for Microsoft Fabric | General KQL entry point | https://learn.microsoft.com/en-us/kusto/query/?view=microsoft-fabric | |||||||||||||||||||||||
39 | Geospatial grid systems in KQL (Microsoft Learn) | Geohash / S2 Cell / H3 Cell reference for spatial queries | https://learn.microsoft.com/en-us/kusto/query/geospatial-grid-systems?view=microsoft-fabric | |||||||||||||||||||||||
40 | KQL geospatial joins | Joining on location signals | https://learn.microsoft.com/en-us/kusto/query/geospatial-joins?view=microsoft-fabric | |||||||||||||||||||||||
41 | KQL geospatial visualizations | Rendering spatial results | https://learn.microsoft.com/en-us/kusto/query/geospatial-visualizations?view=microsoft-fabric | |||||||||||||||||||||||
42 | Microsoft Learn training catalog — search "KQL" | Browse all official self-paced KQL modules and paths | https://learn.microsoft.com/en-us/training/browse/?terms=KQL | |||||||||||||||||||||||
43 | KQL query examples for Microsoft Entra ID (ITPro-Tips) | Copy-paste queries for sign-in / identity auditing | https://itpro-tips.com/kql-query-examples-for-microsoft-entra-id/ | |||||||||||||||||||||||
44 | Anomalous sign-in location hunting query (Azure-Sentinel GitHub) | Real Sentinel hunting query template to study | https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/SigninLogs/AnomalousUserAppSigninLocationIncreaseDetail.yaml | |||||||||||||||||||||||
45 | Microsoft Fabric Eventhouse explained (Kanerika blog) | Medallion architecture & Eventhouse concepts, plain-language | https://kanerika.com/blogs/microsoft-fabric-eventhouse/ | |||||||||||||||||||||||
46 | Azure Monitor: Get started with log queries | Fundamentals of writing/running KQL in Azure Monitor | https://learn.microsoft.com/en-us/azure/azure-monitor/logs/get-started-queries | |||||||||||||||||||||||
47 | Azure Monitor: Log Analytics tutorial | Guided walkthrough building queries step by step | https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial | |||||||||||||||||||||||
48 | Real-Time Intelligence documentation | Eventhouse, Eventstreams, dashboards overview | https://learn.microsoft.com/en-us/fabric/real-time-intelligence/ | |||||||||||||||||||||||
49 | ||||||||||||||||||||||||||
50 | Practice Environments | |||||||||||||||||||||||||
51 | Environment | Access | Link | |||||||||||||||||||||||
52 | Free public Kusto sample cluster (Samples database) | No Azure subscription required, sign in with any Microsoft account | https://dataexplorer.azure.com/clusters/help/databases/Samples | |||||||||||||||||||||||
53 | Log Analytics Demo environment | Free public lab, real sample tables, no cost | https://aka.ms/LADemo | |||||||||||||||||||||||
54 | Microsoft Fabric portal | Sign in with a work/school Microsoft account; free 60-day trial available | https://app.fabric.microsoft.com | |||||||||||||||||||||||
55 | Fabric Real-Time Intelligence end-to-end sample walkthrough | Step-by-step: build Eventstream + Eventhouse + Dashboard from sample data | https://learn.microsoft.com/en-us/fabric/real-time-intelligence/sample-end-to-end | |||||||||||||||||||||||
56 | Fabric lab: Query data in a KQL database | Guided exercise using the RTISample Eventhouse | https://microsoftlearning.github.io/mslearn-fabric/Instructions/Labs/12-query-data-in-kql-database.html | |||||||||||||||||||||||
57 | Fabric lab: Ingest real-time data with Eventstream | Guided exercise building an Eventstream into an Eventhouse | https://microsoftlearning.github.io/mslearn-fabric/Instructions/Labs/09-real-time-analytics-eventstream.html | |||||||||||||||||||||||
58 | ||||||||||||||||||||||||||
59 | Certifications & Vouchers | |||||||||||||||||||||||||
60 | Exam | Focus | Link | |||||||||||||||||||||||
61 | SC-200 | Security Operations Analyst, Sentinel/Defender hunting & detection queries tested directly | https://learn.microsoft.com/en-us/credentials/certifications/security-operations-analyst/ | |||||||||||||||||||||||
62 | SC-500 | Cloud and AI Security Engineer Associate (new, replaces AZ-500), KQL for analytics rules & incident response | https://learn.microsoft.com/en-us/credentials/browse/?terms=SC-500 | |||||||||||||||||||||||
63 | DP-600 | Fabric Analytics Engineer Associate, Power BI, semantic models, Direct Lake | https://learn.microsoft.com/en-us/credentials/certifications/fabric-analytics-engineer-associate/ | |||||||||||||||||||||||
64 | DP-700 | Fabric Data Engineer Associate, pipelines, lakehouses, Eventhouse & Real-Time Intelligence | https://learn.microsoft.com/en-us/credentials/certifications/fabric-data-engineer-associate/ | |||||||||||||||||||||||
65 | DP-800 | SQL AI Developer Associate, T-SQL, vector search, RAG across SQL Server/Azure SQL/Fabric SQL | https://learn.microsoft.com/en-us/credentials/browse/?terms=DP-800 | |||||||||||||||||||||||
66 | All Microsoft credentials | Full searchable catalog of Microsoft certifications | https://learn.microsoft.com/en-us/credentials/browse/ | |||||||||||||||||||||||
67 | ||||||||||||||||||||||||||
68 | Note: free DP-600/700/800 exam voucher program ran through Fabric Data Days, requested through the Microsoft Fabric Community after attending 2 sessions and completing 3 Learn modules. Summer 2026 vouchers have already been distributed, but it's a great time to start preparing for the next round. | |||||||||||||||||||||||||
69 | ||||||||||||||||||||||||||
70 | Data Days General Resources | |||||||||||||||||||||||||
71 | Resource | Link | ||||||||||||||||||||||||
72 | Data Days homepage | https://aka.ms/DataDays | ||||||||||||||||||||||||
73 | Full Data Days session schedule | https://aka.ms/dd/schedule | ||||||||||||||||||||||||
74 | Get Fabric or SQL certified for free | https://aka.ms/dd/cert | ||||||||||||||||||||||||
75 | Find your Data Days community | https://aka.ms/dd/connect | ||||||||||||||||||||||||
76 | Data Days contests and hands-on challenges | https://aka.ms/dd/create | ||||||||||||||||||||||||
77 | Join a Data Days study group | https://aka.ms/dd/studygroup | ||||||||||||||||||||||||
78 | Power BI DataViz World Championships | https://aka.ms/DatavizWorldChamps | ||||||||||||||||||||||||
79 | Fabric User Panel, influence the roadmap | https://aka.ms/JoinFabricUserPanel | ||||||||||||||||||||||||
80 | Fabric IQ User Panel, influence the roadmap | https://aka.ms/JoinFabricIQUserPanel | ||||||||||||||||||||||||
81 | SQL User Panel, influence the roadmap | https://aka.ms/JoinSQLUserPanel | ||||||||||||||||||||||||
82 | Microsoft Fabric Community | https://community.fabric.microsoft.com | ||||||||||||||||||||||||
83 | Microsoft Fabric documentation | https://learn.microsoft.com/en-us/fabric/ | ||||||||||||||||||||||||
84 | Microsoft Learn training for Fabric | https://learn.microsoft.com/en-us/training/fabric/ | ||||||||||||||||||||||||
85 | Microsoft Reactor (Data Days certification series, livestreams) | https://www.youtube.com/@microsoftreactor | ||||||||||||||||||||||||
86 | ||||||||||||||||||||||||||
87 | Our User Group Links | |||||||||||||||||||||||||
88 | Resource | Link | ||||||||||||||||||||||||
89 | Microsoft Fabric Location Intelligence & Security User Group — Fabric Community group page | https://community.fabric.microsoft.com/group/MicrosoftFabricLocationIntelligenceSecurityUserGroup | ||||||||||||||||||||||||
90 | Microsoft Fabric Location Intelligence & Security User Group — Meetup | https://www.meetup.com/fabric_ug/ | ||||||||||||||||||||||||
91 | Series calendar (all sessions, RSVP & replays) | https://luma.com/calendar/cal-tHzlNbGwXs2tVYB | ||||||||||||||||||||||||
92 | KQL for Data and Security Professionals — event page | https://luma.com/vowwag8m | ||||||||||||||||||||||||
93 | Location Intelligence with Maps and GeoAnalytics in Microsoft Fabric — event page | https://luma.com/jnh0ie5v | ||||||||||||||||||||||||
94 | Global Fabric Day 2026: Security, Location & Intelligence in Microsoft Fabric — event page | https://luma.com/qt0sqetq | ||||||||||||||||||||||||
95 | Get to Know Esri: From Living Atlas to Spatial Analysis for Fabric Users — event page | https://luma.com/quxtq3cy | ||||||||||||||||||||||||
96 | Data and AI Security and Governance in Microsoft Fabric — event page | https://luma.com/16aewof4 | ||||||||||||||||||||||||
97 | Fabric IQ for Data Professionals — event page | https://luma.com/0sx7b9lo | ||||||||||||||||||||||||
98 | GeoCyber Systems YouTube (session replays) | https://youtube.com/@geocybersystems | ||||||||||||||||||||||||
99 | ||||||||||||||||||||||||||
100 | ||||||||||||||||||||||||||