Transforms KQL data on arrival with no separate orchestration: whenever rows land in some source table, a query runs and its output gets appended into another table. Production setups ought to make it transactional.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Update policy in context, with comparison tables and the common traps.
Terms in this definition
- KQL
Kusto Query Language, used read-only to query Azure Data Explorer, Log Analytics and Microsoft Sentinel; log alert rules are written in it too.
- Event
Table in Log Analytics where entries from Windows event logs are kept.
- Agents (classic) API
First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.
Related terms
- Driver update policy
An Intune Windows update policy for reviewing, approving and rolling out driver and firmware updates. Recommended drivers can be approved automatically after a deferral, or each one can be approved by hand.