Notes on KQL syntax join and project

by Joost Agterhoek — on  ,  ,  , 


For my work in the Security Operations & Control Center (SOCC) of the Vrije Universiteit Amsterdam, I spend a lot of time diving into logs, usually through the Kusto Query Language (KQL). Because I keep looking up the same syntax documentation, here I aim to write some small reminders for myself.

joining two tables on differently named columns: join _Table to join_ on $.left._Left table column name_ == $right._Right table column name_

project a column on a certain condition: project [ColumnName [= _Expression_]