Microsoft Sentinel : KQL extend operator

Used to extend the current dataset to columns as per the requirement. In this example, a new column named “BootSince_newColumn” is added to the output using the extend operator. This new variable calculates the time difference since boot time and now.

 

The output shows the newly added column  BootSince_newColumn with the value 2342, which is the number of hours since the boot time.

For a more commonly applicable real world example, extend operator can be used to calculate the number of days sinc...