> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Log Search

> Run KQL queries against a workspace's logs from the ContraForce portal, with a schema browser and Ask IRIS for plain-language queries.

Log Search lets you query a workspace's logs with KQL (Kusto Query Language) without leaving ContraForce, so you can hunt or dig into an incident from the same place you triage it.

<Info>
  **Who is this for?** SOC analysts and security engineers who hunt or investigate across customer workspaces. Log Search is included with the **XDR + SIEM Module**.
</Info>

***

## Running a Query

<Steps>
  <Step title="Open Log Search">
    Select **Log Search** in the left navigation.
  </Step>

  <Step title="Choose the Workspace">
    Pick the workspace and data source from the **Workspace** list, for example **\[workspace] — Microsoft Sentinel**.
  </Step>

  <Step title="Write the Query">
    Type KQL in the editor. Use the **Schema** panel to browse the tables available in the workspace.
  </Step>

  <Step title="Run It">
    Select **Run** or press **Ctrl + Enter**. Results appear in the **Results** panel.
  </Step>
</Steps>

***

## Ask IRIS

Not fluent in KQL? Select **Ask IRIS** and describe what you're looking for in plain language. IRIS turns your description into KQL, which you can review before you run it.

***

## Exporting Results

After a query returns results, select **Export** to download them.

***

## Opening Log Search from an Incident

On a full incident page, select the Log Search icon (**Go to log search**) next to **Actions** to jump to Log Search while you investigate.

***

## Related Guides

<CardGroup cols={2}>
  <Card title="Incident Management" icon="shield-halved" href="/guides/getting-started/incident-management">
    Investigate incidents end to end
  </Card>

  <Card title="Microsoft Sentinel Module" icon="database" href="/guides/onboarding/microsoft-sentinel-module">
    Connect Sentinel to a workspace
  </Card>
</CardGroup>

***

<Note>
  Questions about Log Search? Contact us at [support@contraforce.com](mailto:support@contraforce.com).
</Note>