Instructions - KQ Who?

🔍 How to Play KQ Who?

This isn't your average guessing game — it's cyber detective work! In Guess QL, you'll use real KQL (Kusto Query Language) commands to filter out innocent digital citizens and identify the hidden attacker.

🎯 Objective

Your mission: Find the attacker hidden among quirky characters by using smart KQL queries. Use the data, track their activity, and trust your logic. But be careful — each query counts!

🧠 Key Rules

🧑‍💻 Queries focus on one filter at a time — no combo queries. Keep it simple and surgical.

❌ If your query doesn’t match the attacker, you’ll receive an error and nothing happens.

✅ If your query does match the attacker, the game filters out characters who don’t match — narrowing your grid.

🕵️ When only one character is left — or when you're confident — guess the attacker. Choose wisely!

🎮 Game Modes

🧩 Normal Mode - Use both visual traits and activity logs to solve the case. Classic detective mode!

🖼️ Image Only - Only query visual traits (e.g., Hair, Species, Accessory).

🗃️ Data Only - Only query log data (e.g., FilesDownloaded, VisitedDomains, IP).

💬 Prompt Challenge - Focus in on required filters and build your queries around those.

🎓 Why It’s Cool

You’re not just playing — you're learning real-world skills. KQL is a powerful tool used by cybersecurity analysts to sift through massive data logs and catch digital baddies. By using it in KQ Who?, you’re training to think like a pro.

💡 Example Queries

| where Species == "robot"

Finds only characters who are robots

| where Accessory contains "drink"

Finds characters holding drinks

| where ColorScheme has_any ["gray", "blue"]

Matches characters with either gray or blue colors

| where SuspiciousActivity contains "phishing"

Targets shady behaviors involving phishing

| where VisitedDomains contains "sketchydocs.io"

Identifies websites visited by the attacker

| where ColorScheme has_any "black, white, gray"

Searches characters for any of the three colors in their main scheme

Use KQL to eliminate characters who don’t match the attacker's profile. Every query helps narrow down the field!

== matches exact values

!= excludes exact matches

contains looks for parts of words

like "glasses" inside the word "sunglasses"

!contains excludes parts of words

has checks arrays for a value