KQL for Sentinel, hunting, workbooks and notebooks
The KQL operators a security engineer actually uses in Sentinel, the tables worth knowing, ASIM parsers, functions, the hunting blade, workbooks, notebooks, query cost and performance, search jobs and restore, with 15 ready-to-paste queries.
Overview: what Sentinel is, licensing and workspace design
Microsoft Sentinel as SIEM and SOAR on a Log Analytics workspace, its components, the analytics and data lake tiers, pricing and the E5 data grant, the Defender portal as the only home after March 2027, and how to decide on one workspace or many.