Microsoft Sentinel : KQL project operator

Project operator is used to customize the query result output as per your needs. This doesn't remove or modify any logs. It only affects how it is presented for that particular query, for that particular run.

To keep only one particular column details instead of all available columns.



If you wish to remove only a column and keep all other available columns, then use project-away
 

project-rename option can be used to rename the column name. Here in this example, the column with name "Computer" is re...