Microsoft Security: KQL Inner and Outer Joins for Advanced Hunting | Microsoft Defender (Part 2)

Learn how to use inner and outer joins in Kusto Query Language (KQL) to connect tables in Microsoft Defender Advanced hunting. This video explains why the default inner unique join flavor can remove duplicate rows and cause missed detections and how to return every matching row with a standard inner join. It also walks through left outer, right outer, and full outer joins, with examples showing which rows each one returns.



Learn more: https://msft.it/6057amHyF



#MicrosoftDefender