How to get started with investigations

In this tutorial, you will create an investigation and run your first KQL (Kusto Query Language) query.

Getting startedGetting started

The YCDR section will appear in the Security Deck interface after the access request is approved.

You will need the ycdr.admin role to work with investigations.

Create an investigationCreate an investigation

1. Go to Security Deck.
2. In the left-hand panel, select YCDR.
3. Navigate to the Investigations tab.
4. Click New investigation.
5. Enter a name for your investigation, e.g., Failed login analysis.
6. Under Description, add a description: Searching for failed console login attempts within the last 30 minutes.

Create a queryCreate a query

1. In the query editor, enter the following KQL query:

   Events
   | project event_class, ['time']
   | limit 1
   

   This query:

   • Selects events from the Events table.
   • Displays the event_class and time fields.
   • Limits the result to a single entry.

2. Set the time period to Last 30 minutes.

3. Click the query run button.

Analyze the resultsAnalyze the results

After the query is completed, the results are displayed in a table with the following fields:

• event_class: Event class
• time: Event time

This is an example of a simple query which checks service performance. For more complex analysis, use additional queries and filters.

What's nextWhat's next

• Learn more about investigations and queries.
• Learn how to manage investigations.
• Explore working with queries.
• Review the KQL reference.