NQL Syntax Cheat Sheet

<table> during past <time> | where <filter> | compute <calc> | summarize <agg> | list <fields> | sort <field> asc/desc | limit <n>

1. where          (filter early!)
2. with/include   (join events)
3. compute        (per-object calc)
4. summarize      (aggregate)
5. list           (select fields)
6. sort           (order results)
7. limit          (restrict rows)

/* This is a comment */
/* Multi-line comments
   are supported */

/* ⚠️ Comments do NOT work within clauses */
/* ✅ CORRECT - Comment between clauses */
devices
/* Filter to Windows devices */
| where operating_system.platform == windows
| list device.name

/* ❌ WRONG - Comment within clause (will error!) */
| where /* filter */ operating_system.platform == windows

during past 1d    # 1 day (low-resolution, cloud timezone)
during past 7d    # 7 days (daily aggregation)
during past 24h   # 24 hours (high-resolution, user timezone)
during past 48h   # 48 hours (5-15 min samples)

⚠️ past 2d ≠ past 48h (different resolution & timezone!)

count()              # Count events (avoid on sampled events!)
device.count()       # Count unique devices (use this!)
user.count()         # Count unique users
application.count()  # Count unique applications
field.sum()          # Total
field.avg()          # Average (use this for computed averages!)
field.max()          # Maximum
field.min()          # Minimum
field.last()         # Most recent value

where name = "Microsoft*"        # Starts with Microsoft
where name = "*Office*"          # Contains Office
where name = "*.exe"             # Ends with .exe
where os.name = "Windows 1?"     # Single char wildcard (10, 11)

==  or  =    # Equals (both work)
!=           # Not equals
>            # Greater than (numbers, dates, durations)
<            # Less than
>=           # Greater or equal
<=           # Less or equal
in [ ]       # In list: where name in ["chrome.exe", "firefox.exe"]
and          # Logical AND
or           # Logical OR
not          # Logical NOT

value.as(format = percent)                # 0.47 → 47%
value.as(format = currency, code = USD)   # 2000 → $2,000
value.as(format = bytes)                  # 1073741824 → 1 GB
value.as(format = bitrate)                # 1500000 → 1.5 Mbps
value.as(format = energy)                 # 1500 → 1.5 kWh

/* ❌ compute after summarize */
summarize total = sum() | compute percent = total / 100  # ERROR!
/* ✅ summarize percent = sum() / 100  # Correct */

/* ❌ Reference variables within same summarize */
summarize a = sum(), b = a / 100  # ERROR!
/* ✅ summarize a = sum(), b = sum() / 100  # Correct - repeat calculation */

/* ❌ count() on sampled events */
execution.events | summarize total = count()  # Returns sample count!
/* ✅ execution.events | summarize total = device.count()  # Useful! */

/* ❌ Missing time window on events */
execution.events | summarize count = count()  # ERROR!
/* ✅ execution.events during past 7d | summarize count = count()  # Correct */

/* ❌ Exceeding retention limits */
execution.events during past 15d  # May fail (8-day high-res limit)!
/* ✅ execution.events during past 7d  # Within limits */

devices                      # Device inventory (no time needed)
execution.events             # Process execution (8d high-res, 30d low-res)
execution.crashes            # Application crashes
device_performance.events    # CPU, memory, disk metrics
connection.events            # Network connections (8d high-res, 30d low-res)
web.events                   # Web browsing

□ Event table has "during past Xd" or "during past Xh"
□ Filters use correct operators (= for strings, > for numbers)
□ No compute after summarize
□ No variable references within same summarize
□ Field names match table (check Field Reference if unsure)
□ Using device.count() not count() on sampled events
□ Added | limit 10 for testing

/* Find top 20 devices by metric */
execution.events during past 7d
| where binary.name = "PROCESS.exe"
| summarize metric = field.avg() by device.name
| list device.name, metric
| sort metric desc
| limit 20

/* Hourly trend analysis */
execution.events during past 7d
| where binary.name = "PROCESS.exe"
| summarize metric = field.avg() by 1h
| sort start_time asc

/* Complete device inventory with metrics */
devices
| include execution.events during past 7d
| compute metric = field.sum()
| list device.name, metric
| sort metric desc

devices
| with execution.crashes during past 7d
| where binary.name = "app.exe"
| summarize crash_count = count()

devices
| include execution.crashes during past 7d
| compute has_crash = count()
| summarize
    total_devices = count(),
    devices_with_crashes = has_crash.countif(has_crash > 0),
    crash_percentage = (has_crash.countif(has_crash > 0) * 100.0) / count()

/* with - Only objects WITH events (filters) */
devices
| with execution.crashes during past 7d
| list device.name
/* Returns: 15 devices (only those with crashes) */

/* include - ALL objects with metrics (computes) */
devices
| include execution.crashes during past 7d
| compute crash_count = count()
| list device.name, crash_count
/* Returns: 142 devices (all devices, crash_count = 0 for some) */

device.name
device.operating_system.name
device.hardware.memory
device.volumes.size
device.department

context.os_name                    # OS at event time
context.device_platform
context.hardware_model
context.department

binary.name                        # Process name
binary.real_binary.version
cpu_time                           # CPU usage
real_memory                        # Memory consumption
execution_duration
startup_duration

event.destination.domain
event.number_of_connections
event.failed_connection_ratio
incoming_traffic
outgoing_traffic
connection_establishment_time      # RTT