New KQL Data Types
Five more data sources can be queried with KQL as typed tables — Zscaler, Cisco Meraki, F5 BIG-IP LTM, Palo Alto Networks Cortex alerts and incidents, and Qualys — each released with sample queries. Windows audit events, whose schema shipped in v2.6.16, gain sample queries too.
New data types
| Data type | Source |
|---|---|
Zscaler | Zscaler |
Meraki | Cisco Meraki |
F5BigIPLTM | F5 BIG-IP Local Traffic Manager |
CortexAlert, CortexIncident | Palo Alto Networks Cortex XDR |
Qualys | Qualys |
They join the FortiGate traffic and event tables and the Office365, WindowsAudit, GSuite and CloudTrail schemas added in v2.6.16. Sample queries for WindowsAudit, covering event logs from Windows servers, ship with this release.
Writing queries
The record's time is the timestamp column, so a time filter is written where timestamp > ago(1d). Columns from the Azure Monitor tables, such as TimeGenerated, do not exist here.
WindowsAudit
| where timestamp > ago(1d)
| summarize Events = count() by EventID
| order by Events desc
See KQL for the data model and query cost.