Skip to main content

Azure Data Explorer KQL cheat sheets

Azure Data Explorer KQL cheat sheets: Kusto Query Language is a powerful intuitive query language, which is being used by many Microsoft Services. KQL Language concepts​   Relational operators (filters, union, joins, aggregations, …)​ Each operator consumes tabular input and produces tabular input​ Can be combined with ‘|’ (pipe).​ Sim...

Comments

Post a Comment

Popular posts from this blog

Qradar Scripts and Results Part 1. Disk Space and Qradar Persistent Queue

______________________________________________________________________________________________________ Script examples written by Travis Hutchings thutch901@gmail.com 865.405.8830 _______________________________________________________ Disk Space and Alerting Results specific to Qradar servers and environments. General Linux script concepts can also be applied to system administration concepts. This disk space script utilizes a few Qradar support functions. 1. Disk Space Alerting and results in /store volume List disk space for all Qradar servers: df- h /opt/qradar/support/all_servers.sh -a '15%' 'df -h /store' >> $listFile List the top of the directory to see file dates and times to determine if Persistent Queue is processing: /opt/qradar/support/all_servers.sh -a '15%' 'ls -l /store/persistent_queue/ecs-ec-ingress.ecs-ec-ingress | head -6' >> $listFile Bottom of the Persistent Queue and seeing if results are processing: /opt/qradar/suppor...
Post a Comment
Read more

LINUX- Qradar EPS Report by Log Source BASH Script by and Log Source Groups

______________________________________________________________________________________________________ Script examples written by Travis Hutchings thutch901@gmail.com 865.405.8830 _______________________________________________________ Bash shell script examples for eps by log source as csv: #Version: 1.5 #Owner: TravisH Corporation #Document Purpose: EPS storage metric script clientName="TravisH" emailFrom="qradar.activ@travishcorp.com" emailTo="Travis.H@travishcorp.com" listFile="/store/scripts/eps_storage_raw.csv" bodyFile="/store/scripts/eps_storage.csv cd /store/scripts/results/ /opt/qradar/support/deployment_info.sh -A echo "" >> $listFile echo "" >> $listFile echo "Log Source:" >> $listFile psql -A -F"," -U qradar -c "select sensordevice.hostname as LogSource, peakeps60s as EPS, to_timestamp(round(sensordevice.creationdate/1000)) as created, to_timestamp(sensordevice.times...
Post a Comment
Read more