KQL Inner and Outer Joins for Advanced Hunting | Microsoft Defender (Part 2)
MentionsMicrosoftMicrosoft Defender
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
Learn how to use inner and outer joins in Kusto Query Language (KQL) to connect tables in Microsoft Defender Advanced hunting. This video explains why the default inner unique join flavor can remove duplicate rows and cause missed detections and how to return every matching row with a standard inner join. It also walks through left outer, right outer, and full outer joins, with examples showing which rows each one returns. Learn more: https://msft.it/6057amHyF #MicrosoftDefender
Description from Microsoft Security.