Microsoft Sentinel
Hunting and detectionRun KQL queries on the Microsoft Sentinel data lake using APIs
In brief
The page received metadata updates, clearer wording about programmatic KQL queries, added context for server timeout, query consistency, and read-only enforcement options, and a resources section.
What Defender admins need to know
No administrator action is required; the added context may help when reviewing automated or high-scale query usage.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Run KQL queries on the Microsoft Sentinel data lake using APIs
Microsoft Sentinel data lake supports running Kusto Query Language (KQL) queries programmatically by using REST APIs. ThisUsing the REST APIs enables security teams and automation systems to retrieve analytical results without using the Azure portal or interactive query editors.
This article explains when to use the API, required permissions, and how to submit a basic query request.
When to use the KQL query API
- Query consistency
- Read-only enforcement
TheseServer timeout, query consistency, and read-only enforcement options are useful when running queries in automated or high-scale environments.
sample payload:
## Related content
For more information, see the following resources:
- [Run KQL queries on the Microsoft Sentinel data lake](kql-queries.md)
- [Microsoft Sentinel data lake overview](sentinel-lake-overview.md)
- [Onboarding to Microsoft Sentinel data lake](sentinel-lake-onboarding.md)
@@ -8,15 +8,15 @@ ms.reviewer: zeinam ms.service: microsoft-sentinel ms.subservice: sentinel-platform ms.topic: how-to-ms.date: 06/12/2026+ms.date: 07/01/2026 ms.collection: ms-security ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Run KQL queries on the Microsoft Sentinel data lake using APIs -Microsoft Sentinel data lake supports running Kusto Query Language (KQL) queries programmatically by using REST APIs. This enables security teams and automation systems to retrieve analytical results without using the Azure portal or interactive query editors.+Microsoft Sentinel data lake supports running Kusto Query Language (KQL) queries programmatically by using REST APIs. Using the REST APIs enables security teams and automation systems to retrieve analytical results without using the Azure portal or interactive query editors. This article explains when to use the API, required permissions, and how to submit a basic query request. ## When to use the KQL query API@@ -90,7 +90,7 @@ You can include additional execution options in the request payload, such as: - Query consistency - Read-only enforcement -These options are useful when running queries in automated or high-scale environments.+Server timeout, query consistency, and read-only enforcement options are useful when running queries in automated or high-scale environments. sample payload: ```json@@ -116,6 +116,8 @@ Query execution is subject to time and result size limits. For current limits, s ## Related content +For more information, see the following resources:+ - [Run KQL queries on the Microsoft Sentinel data lake](kql-queries.md) - [Microsoft Sentinel data lake overview](sentinel-lake-overview.md) - [Onboarding to Microsoft Sentinel data lake](sentinel-lake-onboarding.md)