Wildcards, Ranges and exists

What is it?

KQL adds power beyond exact match: wildcards (user.name:svc-*), numeric and date ranges (http.response.bytes > 1000000, @timestamp >= "2026-08-25"), and exists (source.ip:* to require the field be present).

Why it matters

Real questions are rarely exact: 'any service account' is a wildcard, 'uploads over a megabyte' is a range, 'events that actually have a destination' is exists. These turn a vague hunch into a runnable query.

Where you see it

`user.name:svc-* and event.outcome:failure`; `http.response.bytes > 1048576`; `destination.ip:* and not destination.ip:10.0.0.0/8` (has an external destination).

What normal looks like

A wildcard or range that returns the bounded set you intended — service accounts only, large transfers only — and an exists filter that removes documents where the field is simply absent.

What suspicious looks like

Not the operator — but an over-broad wildcard (*admin*) can match far more than intended, and a range with the wrong unit (bytes vs MB) silently returns the wrong set. Sanity-check the count.

How analysts investigate

Reach for a wildcard when you want a family of values, a range when you have a threshold, and exists when the presence of a field is itself the signal. Then verify the result size matches your expectation.

Common beginner mistakes

A wildcard so broad it matches unrelated values — anchor it (svc-* not *s*).
Getting the range unit wrong (searching bytes as if megabytes), returning the wrong events.

Partial values, thresholds, presence

  wildcard:  user.name:svc-*                 → every service account
  range:     http.response.bytes > 1048576  → transfers over 1 MB
  date:      @timestamp >= "2026-08-25T00:00"
  exists:    destination.ip:*               → documents that HAVE a destination
  combine:   user.name:svc-* and http.response.bytes > 1048576

Wildcards match value families, ranges express thresholds, and field:* requires the field to exist.

Quick check

You want failed logins from ANY service account (they are named svc-payroll, svc-batch, …). Which KQL?

A quick self-check — it doesn't affect your XP or progress.