KQL essentials for threat hunting

SC-200 · Perform threat hunting · Updated

Core KQL operators for hunting in Defender XDR and Sentinel, with the patterns the exam uses for filtering, summarizing and time charts.

This lesson is part of full SC-200 access

The first 2 SC-200 lessons are free. Full access opens every lesson with its practice questions, and the exam-style SC-200 question bank.

In this lesson
  • The pipeline model
  • Operators to know
  • Join tips
  • Defender XDR tables and functions
  • Visuals
  • Exam traps
  • Practice questions

Get full access Try the free practice exam Log in

SC-200 course outline

All 9 lessons · Course overview
  1. Microsoft Sentinel workspaces, roles and data connectorsManage a security operations environment Free
  2. Defender for Endpoint onboarding, device groups and rolesManage a security operations environment Free
  3. Defender for Cloud plans, servers and security postureConfigure protections and detections Full access
  4. Sentinel analytics rules, UEBA and threat intelligenceConfigure protections and detections Full access
  5. Defender XDR custom detections and alert tuningConfigure protections and detections Full access
  6. Sentinel automation rules and playbooksManage incident response Full access
  7. Investigating incidents and responding on devicesManage incident response Full access
  8. KQL essentials for threat huntingPerform threat hunting Full access
  9. Hunting tools in Sentinel and Defender XDRPerform threat hunting Full access