SIEM Tutorial

This module introduces the foundational concepts of KQL, equipping SOC analysts with the skills needed to investigate security events efficiently. Through practical examples and hands-on exercises, you’ll learn how to:

• Search and interpret security data using KQL
• Filter, parse, aggregate and transform event data to expose meaningful patterns
• Build queries and visualizations that support threat hunting and incident triage

By the end of this module, you’ll be able to construct efficient KQL queries that surface security-relevant insights from noisy log data—faster and with more precision.