Tobias Zimmergren • 3/31/2022

Obfuscate strings in KQL queries

This article explains how to protect sensitive information like Personally Identifiable Information (PII), API keys, and user accounts in KQL queries for Azure Data Explorer (ADX). It demonstrates how query logs can expose plain-text strings and provides a simple method to obfuscate them by prepending 'h' or 'H' to string literals. The technique ensures audit logs redact sensitive data while remaining valid for auditing purposes. Includes examples of queries with and without obfuscation, and links to official Microsoft documentation.

0 comments

#Kql #Azure Data Explorer #Audit Logs