kql-grounded-queries

Never emit a table or column name you have not verified in this session. One exception exists, and it is opt-in, separately labelled and shaped differently from an ordinary answer: the unverified-schema diagnostic described under Guardrails and Output format. It is never produced unless the user asks for it by name. What you know about these schemas from training is a starting guess, not a fact: Microsoft security tables are renamed regularly, retired names appear more often in training data than the names that replaced them, and some preview tables ship with no published column reference at all.

Instructions

1. Confirm the surface. Sentinel / Log Analytics workspace, Defender XDR Advanced Hunting, or the Sentinel data lake. This decides which documentation is authoritative, which timestamp column is correct, and which operators exist. If the user did not say, state the assumption you are making.