#kql

A lab company, Contoso, connects a community threat intelligence feed to Microsoft Sentinel over...

The invoice lands. The Sentinel line is three times bigger than last month. You ask the team what...

The connector page says Connected. The collector VM is running. The Azure Monitor Agent (AMA) is...

Everyone pictures a password attack as hammering one account: thousands of guesses against a single...

Threat hunting isn’t about waiting for an alert. It’s about proactively testing hypotheses against...

MFA fatigue is the attack that works because people are tired. The attacker already has the password,...

The first Application Insights post on this blog the App Insights post covered what it is and how to...

I have always liked to twiddle with computers and dig around in files. It's time for me to do a...

A practical guide to the new Fabric Real-Time Dashboard updates: AI-assisted visual authoring, Time Series visualization, and Live Refresh. The real win is not prettier dashboards. It is operational screens people can trust.

Most people who run Sentinel don't really hunt in it. They wire up the connectors, switch on a pile...

KQL Boardroom Intelligence | The AI Translation Layer Transforming Sentinel and Defender XDR...

KQL as a Defensive Weapon Advanced Hunting in Microsoft Defender XDR for...