<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Hunting with KQL Queries

## KQL Operators

| Operator | Description | Example |
|---|---|---|
| `where` | Filter rows | `where FileName == "cmd.exe"` |
| `project` | Select columns | `project Timestamp, DeviceName` |
| `extend` | Add computed column | `extend Len = strlen(CommandLine)` |
| `summarize` | Aggregate | `summarize count() by DeviceName` |
| `join` | Correlate tables | `join kind=inner (Table2) on Key` |
| `sort by` | Order results | `sort by Timestamp desc` |
| `top` | Limit results | `top 10 by Count desc` |
| `has` | Term match (indexed) | `where CommandLine has "mimikatz"` |
| `has_any` | Any term match | `has_any ("wget", "curl")` |
| `contains` | Substring (slow) | `where Path contains "temp"` |
| `matches regex` | Regex match | `matches regex @"\d{1,3}\.\d+"` |

## Key Tables

| Table | Source | Contents |
|---|---|---|
| `DeviceProcessEvents` | MDE | Process creation with command line |
| `DeviceNetworkEvents` | MDE | Network connections |
| `DeviceFileEvents` | MDE | File operations |
| `DeviceLogonEvents` | MDE | Authentication events |
| `SigninLogs` | Azure AD | Cloud authentication |
| `SecurityEvent` | Sentinel | Windows Security events |
| `Syslog` | Sentinel | Linux syslog |

## Agent Script

```bash
# List available hunt templates
node agent.js list

# Get specific template
node agent.js get encoded_powershell

# Build custom query
node agent.js build --table DeviceProcessEvents --timerange 7d --filter 'FileName == "cmd.exe"'
```
