Microsoft Sentinel

Microsoft Defender

Detection Engineering

Kql

Explore recommended reads, summarized by AI

Security Detection and Threat Hunting

Writing about using query languages to detect threats, investigate security incidents, and analyze logs.

KQL for Threat Detection

Popular this week

Muhammad Essam

CloutHaus — KC7 Investigative Walkthrough:

Bindiya Priyadarshini

Hunting the SAP Execution Gap

In

Detect FYI

by

Stamatis Chatzimangou

Threat Hunting using Pair Probabilities

In

Detect FYI

by

Stamatis Chatzimangou

Detecting GitHound Enumeration via the GitHub API

In

System Weakness

by

William | SOC and Detection Engineering

My KQL Query Counted Two Tag Writes. The Records Told a More Useful Story.

Latest stories

In

Detect FYI

by

Sergio Albea

🔎 𝗞𝗤𝗟 𝗼𝗳 𝘁𝗵𝗲 𝗪𝗲𝗲𝗸 | 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝗦𝘂𝘀𝗽𝗶𝗰𝗶𝗼𝘂𝘀 𝗖𝗹𝗶𝗲𝗻𝘁…

Shahzaib Sajid

The 60-70% False Positive Cut Wasn’t a Magic Rule

Alan

The Server Behind the Phish: Hunting AiTM Token Replay from Hosting ASNs in Microsoft 365

Mohan Krishna Reddy

TOP 20 Detection Logics -SIEM Beginner

Alan Conlon

Hunting Impossible Travel in Sentinel with KQL

See more stories

Who to follow

Popular this week

Muhammad Essam

CloutHaus — KC7 Investigative Walkthrough:

Bindiya Priyadarshini

Hunting the SAP Execution Gap

In

Detect FYI

by

Stamatis Chatzimangou

Threat Hunting using Pair Probabilities

In

Detect FYI

by

Stamatis Chatzimangou

Detecting GitHound Enumeration via the GitHub API

In

System Weakness

by

William | SOC and Detection Engineering

My KQL Query Counted Two Tag Writes. The Records Told a More Useful Story.

Latest stories

In

Detect FYI

by

Sergio Albea

🔎 𝗞𝗤𝗟 𝗼𝗳 𝘁𝗵𝗲 𝗪𝗲𝗲𝗸 | 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝗦𝘂𝘀𝗽𝗶𝗰𝗶𝗼𝘂𝘀 𝗖𝗹𝗶𝗲𝗻𝘁…

Shahzaib Sajid

The 60-70% False Positive Cut Wasn’t a Magic Rule

Alan

The Server Behind the Phish: Hunting AiTM Token Replay from Hosting ASNs in Microsoft 365

Mohan Krishna Reddy

TOP 20 Detection Logics -SIEM Beginner

Alan Conlon

Hunting Impossible Travel in Sentinel with KQL

See more stories

Who to follow