> For the complete documentation index, see [llms.txt](https://tosanvelor.gitbook.io/portfolio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tosanvelor.gitbook.io/portfolio/professional-courses-and-career-development/security-operation-center-soc/siem.md).

# SIEM

`Basic Structure`: KQL queries are composed of `field:value` pairs, with the field representing the data's attribute and the value representing the data you're searching for. For example: `event.code:4625`

Windows Security Log Event.

{% embed url="<https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4625>" %}

KQL supports free text search -  allowing you to search for a specific term across multiple fields without specifying a field name for instance "svc-sql1"

`Logical Operators`: KQL supports logical operators AND, OR, and NOT for constructing more complex queries. Parentheses can be used to group expressions and control the order of evaluation. For example - event.code:4625 AND winlog.event\_data.SubStatus:0xC0000072

`Comparison Operators`: KQL supports various comparison operators such as `:`, `:>`, `:>=`, `:<`, `:<=`, and `:!`. These operators enable you to define precise conditions for matching field values. For instance

* `Wildcards and Regular Expressions`: KQL supports wildcards and regular expressions to search for patterns in field values. - event.code:4625 AND user.name: admin\*

<br>

<br>