@DebugPrivilege posted some useful docs here;
Folks, who are into Azure Sentinel. I have released a documentation, where I cover different basic concepts of KQL. It contains 9 chapters with different use-cases, and it walks you through different steps to create a KQL query for the described use-case. https://t.co/CtbVIBJZXz
— Huy (@DebugPrivilege) April 28, 2020
Update: this seems have been updated and moved to here: https://security-tzu.com/2020/08/07/become-a-kql-ninja/