19 May 2023 • 2 min read • Public

Azure KQL: Complexity in a Low Code World

If you've used Microsoft Sentinel, Azure Monitor, or Log Analytics Workspace (LAW) for more than a few minutes, you've inevitably come across the Kusto Query Language, or KQL for short. KQL is the mechanism to pull data out of these repositories for reporting and charting using queries. Users familiar with SQL and Databases will feel right at home with this tool. Analysts who do not have a technical background will struggle though. For as much as Microsoft markets these tools as Low Code and No Code solutions, KQL can be a challenge with a steep learning curve.

Databases and LAWs share much of their DNA, the main difference being LAW as rolling records based on time. This means data within LAW will eventually expire and be discarded. When you need to pull data out of a LAW table, you will need to write a KQL query. If you need some basic data pulled from 1 table, this isn't a huge challenge, but the complexity rises quickly from there. Filtering out data on certain conditions or cross referencing with other tables can be a daunting task. It will require a technical mindset to logically think through the steps that LAW needs to execute in order to correlate the data. For a busy analyst, this is time spent learning how the system works, reading dozens of documentation and syntax pages, and hours worth of testing in order to generate 1 report. The analyst then needs to make sure that the data is there to start with and keep the queries up to date for changing report requirements or schema updates.

The expert team at Senserva helps to address this knowledge gap and build on top of those reports. Our patented solution keeps data current in the LAW, and our focused UI builds custom reports for the time-crunched analyst. The best part is how our team takes care of the KQL for you. Reports are generated by simply selecting your LAW and applying any desired filters with easy selection tools. Our team is able to support your needed reports to your specifications and keeps up with changes as they happen.

Our customer care team at Senserva can help to streamline your reporting needs and build detections & cross reference unique data signals to set you apart from the competition. Contact us today to learn more and schedule a demo.

You might also like!

Senserva and Microsoft announced we are a Security ISV of the Year and Endpoint Management Trailblazer finalist in the Microsoft Security Excellence Awards!

Senserva builds with the Microsoft security products and Microsoft focused security services providers to provide customers a unified solution.

Azure Active Directory 17 Mar 2024 3 min read Public

New Senserva Web Site is On Line

Senserva has a great new web site, its full of details around what we help secure and how we work with high end security partners to provide a full solution.

Azure Active Directory 11 Mar 2024 1 min read Public

Senserva and Bulletproof Solutions Announce Partnership to Develop A Safer Environment for Microsoft Customers

Senserva and Bulletproof Solutions have announced a strategic partnership to develop and deliver industry-leading software solutions to secure customers' Microsoft Entra, Sentinel, and Defender workloads. We look forward to continuing to innovate together to create cutting edge solutions. Please see the below press release from Bulletproof: https://bulletproofsi.com/

Microsoft Security 27 Feb 2024 2 min read Public

If you just need a Database for Storage, you must use Entity Framework

When you are a developer, you fundamentally spend your time working with data. Getting data, changing data, sending data. At some point though, you will need to save the data somewhere. This is where databases come in, storing the data for later to be used or for other programs and

Senserva 28 Jul 2023 2 min read Public

Azure AD Role Scoring

At the time of writing this post, Azure AD contains 91 built-in administrative roles. These roles have varying degrees of power within Azure AD. The team at Senserva has built a scoring system for grading these roles so that our analytics platform can grade each user's power level

Azure Active Directory 10 Jul 2023 8 min read Public

Azure AD Roles: Global Admin Assignment should be a Last Resort

Azure Active Directory has many components to it, with many features and capabilities. These different possibilities necessitate the creation of a Role system in Active Directory, to define any users responsibilities. As of writing there are 91 built-in Azure Active Directory roles that can be assigned. This many options and

Senserva 8 Jun 2023 2 min read Public

Azure AD Conditional Access Best Practices

Today we'll be taking a look at Azure AD Conditional Access. Conditional Access is a feature of Azure AD Premium P1 and P2 that helps organizations control how users access corporate resources

Conditional Access 11 Apr 2023 11 min read Public

In-depth Senserva Insights from CEO Mark Shavlik

The Senserva team and I spent a good amount of time creating the content for this video as we often get asked "What does Senserva do?". Senserva is integrated with Microsoft security products, including Microsoft Sentinel, Defenders, Intune, Azure Active Directory and others.

Azure Active Directory 23 Feb 2023 1 min read Public