Custom GPT for Optimized Kusto Queries in Azure Sentinel & Defender XDR

Building Kusto queries with best practices is time-consuming yet essential. To help streamline this, I built KQL Query Builder — a Custom GPT that generates efficient, optimized KQL from natural-language prompts.

Fig 1: How it looks like

How it works

• Describe what you need (e.g., “Detect users with failure spikes and unfamiliar IPs”)
• Inform what environment you have
• Get back a fully optimized query using set ops, materialization, correct environment schemas, etc.
• Compatible with Microsoft environments like Sentinel, Azure Monitor, Defender XDR, Entra ID

Fig. 2: User asks for failure spikes detection, and assistant requests environment details

Fig. 3: Final optimized query with field explanation and sources

Why it matters

• Saves time and enforces performance best practices
• Helps those new to KQL learn structure and optimization
• Easy to iterate — prompt again for refined outputs

👉 Launch the KQL Query Builder

What’s Next?

KQL is powerful, but writing and optimizing queries often slows down analysts. With the KQL Query Builder, you can transform a natural language request into a fully optimized query in seconds — saving time, avoiding mistakes, and unlocking insights faster.

👉 Question for you: What scenario would you like to see supported next in KQL? Share your ideas in the comments — your feedback will help guide future improvements.

🔗 Try it yourself

You can start using the KQL Query Builder GPT today: 👉 Launch the KQL Query Builder

If this article helped you, consider sharing it with your team or colleagues working with Azure Monitor, Sentinel, or Microsoft Defender XDR.

Disclaimer: The texts are written by me, with support from Chat GPT. All content was reviewed, validated, and finalized based on my own expertise.