Blue Team · KQL Lab
Learn KQL by hunting.
Ten realistic datasets and 60 guided investigations across identity, endpoint, email, network, Linux, and cloud telemetry. Lab clock: 2026-06-30 12:00 UTC, so ago() counts back from there.
KQL workbench
Compact lab view
The full lab works here. Use Choose challenge to switch tasks; results tables scroll horizontally when needed.
KQL query
Tab complete
Results
– rows
– cols
–
Loading the lab…