search

MicrosoftLearning / SC-200T00A-Microsoft-Security-Operations-Analyst

MIT License
259 stars 202 forks source link

Learning Path 4 - Lab 1 - Exercise 1 - Create queries for Microsoft Sentinel using Kusto Query Language (KQL) #284

Closed LewisGoDeploy closed 1 month ago

LewisGoDeploy commented 1 month ago

What happened?

Learning Path 4 - Lab 1 - Exercise 1 - Create queries for Microsoft Sentinel using Kusto Query Language (KQL)

Description of issue: Error when trying to run search command in KQL

Task 2: Run Basic KQL Statements

  1. The following statement demonstrates the search operator, which searches all columns in the table for the value. In the Query Window enter the following statement and select Run:

search "new"

Screenshot attached. Maximum response size exceeded.

Lab

Other

Relevant screenshots

image

Do you want to help us? 👏

KenMAG commented 1 month ago

I'll test this. I have not seen this happen before.

KenMAG commented 1 month ago

This only happens on the LA Demo site. If you run it in a lab Sentinel instance it is fine. They probably have too many new events. I would skip it for now.

LewisGoDeploy commented 1 month ago

I will skip but please note that the instructions state to use the LA demo site: https://aka.ms/lademo

KenMAG commented 1 month ago

You can use search "location" with the time range at Last 30 minutes. I'll update the instructions and add a note about using "Search"