Microsoft Security Blogs - Kusto

Introduction: Why ClickFix Attacks Are Popular In the beginning of June I presented the session ClickFix: The Gift That Keeps On Giving at OrangeCon.

Local Windows accounts remain a challenge during incident response.

Deep dive into detection engineering best practices focusing on KQL performance, readability, and maintainability for Microsoft Sentinel and Defender XDR.

Last week I noticed the post of John Lambert about a new Kusto operator lift and thought this is something that needs further investigation.

Detection engineering is far more than just writing a couple of rules and you are done, it is about building resilient, high quality detections that detect evolving threats.

Explore Microsoft Defender for Endpoint timeline internals, OneCyber telemetry, MITRE mapping, and DFIR workflows using exported timeline data, jq and KQL.

Learn how to monitor new actions in Microsoft Sentinel and Defender XDR with KQL, Logic Apps, and Graph API.

What started as a single blog in 2023 is now becoming a yearly tradition.

The new GraphApiAuditEvents table in Advanced Hunting have been in Public Preview since July this year.

Logic Apps allow organizations to easily automate processes, in the last blog the APIs to run KQL are discussed.