KQL Queries in Azure?

[mccrilb]

for example:

AzureActivity
| where Caller in (```user```)
| where SubscriptionId == "subscriptionID"
| where ResourceGroup in (```Resource Group```)

Is there a way to do this now, or a feature in the works? We use KQL queries in "Execute a custom hunting query in Microsoft 365 Defender." We have a need to also be able to run them in Azure

[Dmitry_Sarakeev · Accepted solution]

Hi, we have a run KQL query under the Microsoft Sentinel integration - https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-azure-sentinel#run_a...

[mccrilb]

Will that work even though we don't run Microsoft Sentinel? 

[mccrilb]

Thanks! I took a look and I think this will work!