KQL for Data and Security Professionals
📅 Tuesday, August 4, 2026 ⏰ 7:30 – 9:00 AM PT | 10:30 AM – 12:00 PM ET | 2:30 – 4:00 PM GMT | 3:30 – 5:00 PM WAT | 8:00 – 9:30 PM IST 📺 YouTube Livestream
This is Session 5 and the closing session of the Microsoft Fabric Location Intelligence & Security User Group Data Days series, running June through August 2026. 🎙️
KQL is one of the most practical and immediately useful skills you can add to your toolkit in 2026. It is the query language of Microsoft Sentinel, Microsoft Defender, Microsoft Fabric Real-Time Intelligence, and Eventhouse — and it is rapidly becoming a shared language across data engineering, security operations, and AI workloads.
This session is designed for both communities. If you come from a data background, you will learn how KQL extends what you already know. If you come from a security background, you will see how KQL scales beyond threat hunting into operational analytics and business intelligence. And if you attended Win in the Seams on July 25, this session goes deeper on the technical foundations introduced there.
📍 WHAT THIS SESSION COVERS
KQL is not just a security tool or just a data tool. It is the connective language between real-time signals, telemetry, logs, and decisions — and this session shows both communities how to use it across the full Microsoft ecosystem.
YouTube Livestream:
📋 TOPICS
🟣 KQL Foundations for Both Communities • What KQL is and how it differs from SQL: syntax, philosophy, and use cases • Why KQL is optimized for time-series, telemetry, and event data • Core KQL operators every practitioner needs: where, summarize, extend, project, join, render • Reading and writing KQL queries from scratch: a practical walkthrough • How Copilot and natural language can help you write and interpret KQL queries in Fabric • KQL versus SQL: when to use each inside Microsoft Fabric
🟢 KQL in Microsoft Fabric Real-Time Intelligence • What Eventhouse is and how KQL databases are structured inside Fabric • Ingesting streaming data into Eventhouse: Eventstreams, APIs, and connectors • Querying real-time and historical data with KQL inside a Fabric workspace • Building Real-Time Dashboards powered by KQL queries • Eventhouse remote MCP: enabling AI agents to query real-time data using natural language and KQL • Business events flowing automatically into Eventhouse for KQL analysis • Anomaly detection running directly on live time-series and event datasets in Eventhouse • Workspace monitoring: tracking Eventstream health, throughput, and errors using KQL tables
🟠 KQL for Security Professionals • KQL in Microsoft Sentinel: hunting, detection rules, and incident investigation • KQL in Microsoft Defender: endpoint telemetry and threat analytics • Common security KQL patterns: login anomalies, privilege escalation, lateral movement, data exfiltration • Building custom detection rules and watchlists using KQL • Correlating identity signals from Entra ID with security telemetry using KQL • SC-200 and SC-500 certification contexts where KQL skills are directly tested
🔵 KQL for Data Professionals • Using KQL to analyze operational telemetry alongside business data in Fabric • Geospatial and location signals as KQL inputs: correlating event data with location context • Joining security logs with business data to surface operational intelligence • How KQL queries power both security detection and business analytics on the same data • Eventhouse as the connective layer between security logs and OneLake business data • Turning events into decisions before the window closes: practical patterns for data engineers
🩷 Live Query Demonstrations • Writing and running KQL queries live against a Fabric Eventhouse • A security hunting query built and explained step by step • A business analytics query using the same KQL patterns applied to operational data • Using Copilot to generate and refine KQL queries in Real-Time Intelligence • Resources for going deeper: KQL learning path on Microsoft Learn, SC-200 and DP-700 study materials, and community channels
👥 WHO SHOULD ATTEND
This session is for anyone who works with data, logs, telemetry, or real-time signals in the Microsoft ecosystem, including:
✅ Data Engineers and Analytics Engineers working with Real-Time Intelligence ✅ Security Analysts and SOC Engineers using Microsoft Sentinel or Defender ✅ Fabric Architects designing event-driven and real-time analytics solutions ✅ Governance and Compliance professionals working with audit logs and telemetry ✅ Anyone preparing for SC-200, SC-500, DP-700, or DP-800 certification ✅ Anyone who attended Win in the Seams on July 25 and wants to go deeper
No prior KQL experience required. 🛠️
📺 FORMAT
Interactive YouTube livestream with full replay available after the event. This session includes live query demonstrations and Q&A. Come with your KQL questions — beginners and experienced practitioners are both welcome.
ℹ️ ABOUT THIS SERIES
This is the closing session of the Microsoft Fabric Location Intelligence & Security User Group Data Days series, a set of focused 90-minute sessions running June through August 2026 on YouTube.
Series arc: 📍 June 23: Location Intelligence with Maps and GeoAnalytics in Microsoft Fabric 🌿 June 30: Get to Know Esri: From Living Atlas to Spatial Analysis for Fabric Users 🔐 July 7: Data and AI Security and Governance in Microsoft Fabric 🧠 July 21: Fabric IQ for Data Professionals 📊 August 4: KQL for Data and Security Professionals
The Microsoft Fabric Location Intelligence & Security User Group is not affiliated with or run by the Microsoft Fabric Community or the Fabric User Group Network.