Microsoft Sentinel · Techclick Simulator

Microsoft Sentinel Azure Sentinel · KQL

Host: sentinel-tc · Mode: exec Hub

About this lab

SIEM lab with KQL-style queries against dummy SecurityEvent / SigninLogs tables, incidents, and analytics rules.

Student guide (click to run)

Quick commands

show workspaceLog Analytics workspace
show incidentsOpen incidents
show analytics-rulesDetection rules
query SecurityEvent | take 10Sample KQL
query SigninLogs | where ResultType != 0Failed sign-ins
query DeviceProcessEvents | where FileName == "powershell.exe"Process hunt
show watchlistsWatchlists
helpCommand list