Petit test
Guess first, no penalty. You want to hunt for one IP address trying many accounts. Which request gets a query you can check?
KQL (Kusto Query Language) is the query language of Microsoft Sentinel and other Microsoft security tools. A SIEM (a security information and event management system) collects logs in one place, and a hunting query searches them for signs of an attack. AI assistants now draft these queries from plain English. Microsoft's Security Copilot overview lists building KQL queries from natural language as a main use case.
A draft query fails quietly when the AI guesses. So give it what it would otherwise guess:
- Data: the table, such as SecurityEvent, and the fields you know.
- Pattern: what you're looking for, in one sentence.
- Time range: the last hour, the last 24 hours, a specific night.
- Show the working: ask it to explain each field and event ID it relies on. A wrong explanation is the easiest mistake to spot.
A worked example
A prompt (the message you send to the AI):
Write a KQL query for Microsoft Sentinel that finds one IP address
trying to sign in to many different accounts.
Data: SecurityEvent table (TimeGenerated, EventID, Account, IpAddress).
Time range: the last 24 hours.
Return: the query, what each event ID and field means, and one way
I can test it against a time when I know this happened.Complétez les trous
Fill the gaps.
Prompt
Write a KQL query on the for . Explain , and how to test it on a known event.
Try it
Vos étapes, environ 2 minutes
- 1.Write the prompt for one hunt you run often, run it, and read the field and event ID explanations before the query. Add "ask it to explain every field" to your checklist.2 min