My Games
Account π
Sign Up
Login
Global Leaderboard
Case Vault
Badge Backpack
Blue Team Glossary
Login and start playing
Leaving so soon?
×
You really want to log out? We were having so much fun!
Home
βΊ
Glossary
βΊ
Kusto
βΊ
pipe
Pipe
Kusto
Definition
In Kusto Query Language (KQL), a **pipe** (`|`) is used to chain query commands together, passing the results of one operation as the input to the next. Think of it like an assembly line: each stage takes whatever comes down the conveyor belt, works on it, and passes it along to the next stage. Basic example: ```sql SecurityEvent | where EventID == 4625 | summarize count() by Account | sort by count_ desc ``` Step-by-step: 1. `SecurityEvent` β Start with the table. 2. `where EventID == 4625` β Filter only failed logon events. 3. `summarize count() by Account` β Count failed logons per account. 4. `sort by count_ desc` β Sort results from highest to lowest count. Why itβs useful: * Keeps queries readable and modular β you can add, remove, or rearrange stages without rewriting everything. * Encourages logical flow, where each step builds on the previous one. * Makes it easy to debug β run the query up to a certain pipe to see intermediate results. In investigations, pipes are essential when you need to: * Filter β aggregate β sort data in sequence. * Build queries that are easy to share and explain to teammates. * Apply multiple transformations to a dataset without creating temporary tables. Real-world example in threat hunting: ```kusto SigninLogs | where ResultType != 0 | where IPAddress in (externaldata(badIPs:string)["https://example.com/bad-ips.csv"]) | summarize count() by IPAddress | sort by count_ desc ``` Here, the pipe flows from filtering β cross-referencing with bad IPs β counting β sorting, giving a clear trail of logic. Further reading: * Microsoft Learn β Kusto Query Language Overview: [https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/) * KQL Best Practices: [https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/best-practices](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/best-practices)
Explore More Terms
Adx
Processevents
Watering-Hole
Checkpoint
Initial Access