MustLearnKQL - The Workflow

This is a basic example of how to use @RodTrent's KQL workflow to go from blank canvas to actionable query.

MustLearnKQL Github repo https://aka.ms/MustLearnKQL - Everything Rod produces can be found here.
Get the Ebook
Get the Paperback
MustLearnKQL Store (all profit goes directly to St. Jude)
KQL Best Practices

Website: www.cyberautomate.io
Twitter: @cyberautomate
https://github.com/cyberautomate