[Yandex Cloud documentation](../index.md) > [Yandex SIEM](index.md) > Getting started

# Getting started with Yandex SIEM

{% note info %}

This feature is in the [Preview](../overview/concepts/launch-stages.md) stage. To get access, contact [tech support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

In this tutorial, you will create an investigation and run your first [KQL (Kusto Query Language)](kql-reference.md) query.

## Getting started {#before-you-begin}

The Yandex SIEM section will appear in the Cloud Center interface as a Security Deck module after the access request is approved.

You need the `ycem.editor` [role](../iam/roles-reference.md#ycdr-admin) to use the service.

## Create an investigation {#create-investigation}

1. Go to [Security Deck](https://center.yandex.cloud/security/).
1. In the left-hand panel, select **Yandex SIEM**.
1. Navigate to the **Investigations** tab.
1. Click **New investigation**.
1. Enter a name for your investigation, e.g., `Failed login analysis`.
1. Under **Description**, add a description: `Searching for failed console login attempts within the last 30 minutes`.

## Create a query {#create-query}

1. In the query editor, enter the following KQL query:

   ```kql
   Events
   | project event_class, ['time']
   | limit 1
   ```

   This query:
   * Selects events from the `Events` table.
   * Displays the `event_class` and `time` fields.
   * Limits the result to a single entry.

1. Set the time period to **Last 30 minutes**.
1. Click the query run button.

## Analyze the results {#analyze-results}

After the query is completed, the results are displayed in a table with the following fields:

* `event_class`: Event class.
* `time`: Event time.

This is an example of a simple query which checks service performance. For more complex analysis, use additional queries and filters.


## What's next {#whats-next}

* Learn more about [investigations](concepts/investigations.md) and [queries](concepts/queries.md).
* Learn how to [manage investigations](operations/investigations/manage-investigations.md).
* Explore [working with queries](operations/queries/index.md).
* Review the [KQL reference](kql-reference.md).