Kusto Query Language — platform-agnostic

This skill encodes the language-level discipline shared across Microsoft Sentinel (Log Analytics) and Microsoft Defender Advanced Hunting (M365 Defender). For platform-specific table schemas, time-field names, NRT/scheduled-rule constraints, retention and execution surfaces, always pair with microsoft-sentinel or microsoft-defender-endpoint.

Note on time-field naming: Sentinel tables use TimeGenerated. Defender device/email tables use Timestamp. The optimisation principles in this skill are identical — always filter on the datetime index first.

1. Operator hierarchy and string operations

1.1 Filter cascade — most efficient first