Usually when we do KQL investigations, we start with one query, execute it, then analyze the results, copy some data from the results and craft subsequent queries with those data points to continue this loop of investigation. When we go back and look at a historical investigation kql query tab, you will see the queries but not the results and it is hard to follow the chain of thought for that investigation. Ask is to make KQL Querysets similar to Jupyter Notebooks, where queries and results are collected and you can follow the sequence. We should be able to expand or fold the results pane for each query. The results should also be saved inside the KQL querysets along with the timestamp when the query was executed. Because the data in the data source could expire and we might still need that data to understand the investigation conclusion that was arrived at in future.
... View more