Microsoft XDR, KQL, real-world security engineering, and other fun stuff from DevSecOpsDad, your friendly neighbourhood Attack Surface Samurai.

  • Anatomy Of A Kql Query Part 1

    Posted on April 6, 2023

    Introduction and Use Case: Whether you’re new on the SOC or a seasoned Sentinel Ninja, here are some basic queries I keep coming back to when investigating anything odd about my ingest patterns (and thus my overall cost). Query Breakdown So how do you know something is “odd” with your... [Read More]