KQL

KQL, the Kusto Query Language, is the query language of Microsoft Sentinel analytics rules and hunting. It is read-only for queries and runs on Azure Monitor Log Analytics, Azure Data Explorer and Fabric. A Sentinel detection is a KQL query plus a schedule, a severity and ATT&CK tags.

What KQL means here

Queries flow through pipes, with operators such as where, summarize and join. The same language runs across several Microsoft data services, so skills carry over between them.

Elastic also has a KQL, the Kibana Query Language, used in custom query rules. The names match and the languages are different.

Example of KQL in Microsoft Sentinel documentation

The Kusto documentation says KQL is read-only for queries, distinguishes management commands with a leading dot, and runs on Log Analytics stores, Azure Data Explorer and Fabric. learn.microsoft.com read 2026-11-03

Terms related to KQL

• Detection rule: A detection rule is a stored query or logic that runs over security data and raises an alert when it matches.
• pySigma: pySigma is the Python library that parses Sigma rules and converts them into queries through installable backend and pipeline plugins.
• EQL: EQL, the Event Query Language, is a query language in Elastic for ordered sequences of events, such as a process start followed by a network connection from the same host.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.