How to Join Tables in KQL | Microsoft Defender Advanced Hunting (Part 1)

Name: How to Join Tables in KQL | Microsoft Defender Advanced Hunting (Part 1)
Uploaded: 2026-10-26T16:00:35.000Z
Description: Learn the basics of joining tables with Kusto Query Language (KQL) in Microsoft Defender Advanced Hunting. Using two simple demo tables, this video explains how a shared key column links rows across tables and what happens when one key matches more than one row.

Microsoft SecurityOctober 26, 2026

MentionsMicrosoft Microsoft Defender

Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.

Learn the basics of joining tables with Kusto Query Language (KQL) in Microsoft Defender Advanced Hunting. Using two simple demo tables, this video explains how a shared key column links rows across tables and what happens when one key matches more than one row. It then shows the same join as a KQL query in the Advanced hunting query editor, including how the default join flavor removes duplicate rows from the left table. Learn more: https://msft.it/6051aaYzc #KQLjoins #KQLjointutorial #KustoQueryLanguage

Description from Microsoft Security.

Watch on YouTube