Microsoft Security Operations AnalystMitigate threats using Microsoft SentinelMedium
A security analyst is investigating a potential insider threat incident in Microsoft Sentinel. The analyst needs to identify all files accessed by a specific user account across multiple data sources (e.g., SharePoint, Azure Storage, local file shares) within a defined time frame. Which Kusto Query Language (KQL) operator would be most effective for combining log data from these disparate sources to get a unified view of file access activities?
- Amerge
- Bunion
- Clookup
- Djoin
Show answer & explanationAnswer & explanation
Correct answer: B. union
The 'union' operator in KQL is specifically designed to combine the results of multiple tables or expressions into a single result set, provided they have compatible schemas. This is ideal for getting a unified view of similar activities (like file access) across different data sources in Sentinel.
Why the other options are wrong
- A. There is no 'merge' operator in KQL for combining tables in this context; 'join' is the closest equivalent for relational merging.
- C. The 'lookup' operator enriches a table with data from a dimension table, typically for adding context, not for combining primary log sources.
- D. The 'join' operator combines rows from two tables based on matching values in specified columns, which is less efficient for simply stacking similar data from different sources.
KQL 'union' operator
The 'union' operator in KQL combines the rows of two or more tables or tabular expressions into a single result set. It's useful for aggregating similar data from different sources.
- Appends rows, not columns.
- Requires compatible schemas (similar columns).
- Can be used with 'kind=outer' to include all rows even if schema differs slightly.
Memory trick: Union: Unite Similar Logs!