Lab 2, Step 3: clarify where to run the KQL query + realistic ingestion timing

[abdie-grcengineer]

Two documentation clarity fixes for Lab 2 (labs/02-toolkit), Step 3, both found and verified while running the lab end-to-end on a fresh free subscription. Neither is a broken command — both are gaps that make correct setups look broken.

Finding 1 — the AzureActivity KQL query is easy to run in the wrong place/mode

The query is formatted like the shell command blocks around it, so following the "paste the next block" flow lands you in the wrong tool:

• Terminal: pasting the raw multi-line KQL into bash/zsh throws zsh: parse error near '|' (reproduced). Nothing flags it as portal-only.
• Portal: "Logs" frequently opens in Simple mode (no KQL text box), and it's easy to land on the subscription-level Activity Log blade instead — both read as "there's no editor."

Fix: Step 3 now states the query is KQL (not a shell command) and gives two explicit paths — the portal Logs blade (not Activity Log) with the Simple → KQL mode toggle called out, and a copy-paste CLI equivalent (az monitor log-analytics query ...) for people who'd rather stay in the terminal.

Finding 2 — ingestion timing understated for a brand-new workspace

The step says ingestion lags "~5–10 minutes." On a brand-new workspace the first AzureActivity rows can take 30–60 minutes to appear at all.

Verified live: routing correct, workspace resolves, Administrative category enabled, a confirmed tag write captured — yet the table was still 0 rows 20 minutes after that write. A student following the current text concludes they broke something.

Fix: Step 3 now states the first-ingestion delay explicitly (mirroring the Defender first-cycle note in Step 4) and reframes an empty table as "wait, not broken."

Scope

• One file changed: labs/02-toolkit/README.md (Step 3 only).
• No script or command behavior changed — documentation clarity only.

🤖 Generated with Claude Code

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 7b38d8b5-ac10-4467-9c38-a0ed1e10113b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}