KQL hunting workflow
Choose the table that contains the evidence you need, constrain the time range, filter deliberately, project useful fields, then summarize or correlate only when the investigation requires it.
- where filters rows.
- project selects fields.
- summarize aggregates evidence.
- extend creates calculated columns.
- join correlates compatible datasets.