Cyber for all

Stay informed, stay secure, and stay one step ahead of adversaries with KQL

GraphApiAuditEvents: The new Graph API Logs

Bert-Jan Pals published on 2025-08-19 included in KQL Detection Engineering Threat Hunting

The new GraphApiAuditEvents table in Advanced Hunting have been in Public Preview since July this year. These valuable logs give new insights into the activities that are performed using the Graph API in your tenant, which makes it a table you definitly want to explore in the upcoming weeks. The GraphApiAuditEvents table is the ‘free’ version of the MicrosoftGraphActivityLogs table that was available in Sentinel. The GraphApiAuditEvents enables more organizations to use these valuable logs without burning their budget.

Hunting Through APIs - Logic App Edition

Bert-Jan Pals published on 2025-07-15 included in KQL Sentinel Defender for Endpoint Threat Hunting Defender XDR SOC Automation

Logic Apps allow organizations to easily automate processes, in the last blog the APIs to run KQL are discussed. This blog builds upon the knowledge of the previous blog and explains how the Graph API, Azure Monitor API and Defender ATP API can also be integrated into Logic Apps. If you do not run automation solutions via Logic Apps and Sentinel yet, I highly recommend having a look at the previous blogs and Logic Apps below to get an idea of what the possibilities are.

Hunting Through APIs

Bert-Jan Pals published on 2025-06-11 included in KQL Sentinel Defender for Endpoint Threat Hunting Defender XDR SOC Automation

In today’s blog, we’re diving into the world of hunting through APIs. In the blog, the advantages, limitations, and scopes of the Graph API, Azure Monitor API, and Defender ATP API are discussed. For all of these solutions, a ready-to-use PowerShell script is shared. These APIs can enhance security operations, automate threat detection, and enable bigger automation potential. In this blog the following topics are discussed: Available Data Permissions API Limitations Hunting Through PowerShell Hunting the Hunters The next blog explains how these APIs can be used in Logic Apps, so stay tuned for the next one!

Investigating ClickFix Incidents

Bert-Jan Pals published on 2025-05-06 included in KQL Incident Response SOC Defender for Endpoint

With ClickFix being one of the popular delivery methods for malware, infostealers and state-sponsored hackers it is time to share a blog on investigating these incidents using Defender For Endpoint. In ClickFix campaigns a fake (captcha) message is displayed forcing users to validate that they are human. The ‘validation’ executes a malicious command using Windows + Run. The topic discussed in this blog: Initial Compromise The Incident Device Timeline ClickFix Triage Query Next Steps Detection Possibilities Initial Compromise In the simulated ClickFix scenario the user John Davis visited the page as seen below on the lookout for content related to cloud robots.