Beginner
KQL Core: Filter First
Learn to isolate signal early so every later stage is faster, cleaner, and more accurate.
Theory Academy
Learn Then Practice
Complete theory modules in sequence, then launch mapped labs for immediate practical reinforcement.
Academy progress: 0/8
18m
Intermediate
KQL Core: Summarize and Rank
Convert raw events into behavior metrics and ranked queues that analysts can act on.
Requires: kql-1
Advanced
KQL Core: Time and Sequence
Use time windows and event transitions to detect attacker progression, not isolated events.
Requires: kql-2