Welcome to Part 2  of our KQL in Security Operations Series . Last time, we introduced Kusto Query Language (KQL)  and explored why it is critical for SOC analysts using Microsoft Sentinel. We’ll build on that foundation and dive into the fundamentals of querying data —filtering logs, selecting the right fields, and sorting results. Mastering these skills is essential for writing efficient, actionable KQL queries  that power threat hunting, alert investigation, and detection