Let

Kusto

Definition

In Kusto Query Language (KQL), a `let` statement is a way to **define a variable or function** that you can reuse later in your query. Think of it as giving a name to a value, expression, or even an entire subquery so you don’t have to repeat yourself.

The general form is:

```sql
let name = expression;
```

Then later in the query, you can use `name` as if it were part of the original data.

Example – defining a constant:

```sql
let suspiciousUser = "attacker1";
SecurityEvent
| where Account == suspiciousUser
```

Here `suspiciousUser` is a variable holding `"attacker1"`, and we use it in the `where` clause.

Example – defining a calculation:

```sql
let threshold = 100;
SigninLogs
| summarize count() by User
| where count_ > threshold
```

This makes the query easier to update — change the threshold once instead of in multiple places.

Example – defining a subquery:

```sql
let failedLogins = 
    SecurityEvent
    | where EventID == 4625
    | summarize count() by Account;
failedLogins
| where count_ > 10
```

Here `failedLogins` is a named table created by the subquery, which you can treat like any other table in the rest of your query.

`let` is especially useful in investigations for:

* Storing **known bad indicators** like domains, hashes, or IPs
* Setting **thresholds** for alerting or filtering
* Building **reusable subqueries** for stages of your analysis

Further reading and examples:

* Microsoft Docs: [https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/letstatement](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/letstatement)
* KQL Patterns: [https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/kusto-query-examples](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/kusto-query-examples)
* Practical SOC use cases: [https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/kql-tips-and-tricks-for-threat-hunting/](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/kql-tips-and-tricks-for-threat-hunting/)

Explore More Terms

Practice in These Games

A Storm is Brewing in the Lab - TEST

We are back at the Envolvelabs research lab, but things aren't so calm this time around. Your job is to safeguard EnvolveLabs, a leading research hub in Ukraine, and its dedicated team from potenti...

View Game