Cyber for all

Stay informed, stay secure, and stay one step ahead of adversaries with KQL

[DxBP] Part 1 - Technical Detection Engineering Best Practices

Bert-Jan Pals published on 2026-02-23 included in KQL Detection Engineering Threat Hunting

Detection engineering is far more than just writing a couple of rules and you are done, it is about building resilient, high quality detections that detect evolving threats. This blog series covers both the technical and process related best practises of detection engineering. These best practices help you to build better custom detections or analytics rules and optimizes the process in which these detections are deployed and analysed. This blog series starts with three parts and will be expanded over time as additional detection best practice blogs are added.

Defender for Endpoint Timeline Internals

Bert-Jan Pals published on 2026-01-26 included in KQL Defender for Endpoint SOC Incident Response

Explore Microsoft Defender for Endpoint timeline internals, OneCyber telemetry, MITRE mapping, and DFIR workflows using exported timeline data, jq and KQL.

Monitor New Actions in Sentinel & Defender XDR (V2)

Bert-Jan Pals published on 2026-01-19 included in KQL Sentinel Automation SOC Defender XDR

Learn how to monitor new actions in Microsoft Sentinel and Defender XDR with KQL, Logic Apps, and Graph API. Automate weekly reports and improve SOC detection engineering.

KQL Sources: 2026 Update

Bert-Jan Pals published on 2026-01-05 included in KQL Sentinel Defender for Endpoint

What started as a single blog in 2023 is now becoming a yearly tradition. Each year, the KQL community expands with new repositories and queries. The list does not cover just security, but also Intune, Entra, and Azure Monitor. This year, an extra step is taken to remove some AI generated slop repositories from the list to share correct example repositories. Happy New Year to all of you! Highlights #100DaysOfKQL Starting the highlights of this year with the #100DaysOfKQL series done by SecurityAura.

GraphApiAuditEvents: The new Graph API Logs

Bert-Jan Pals published on 2025-08-19 included in KQL Detection Engineering Threat Hunting

The new GraphApiAuditEvents table in Advanced Hunting have been in Public Preview since July this year. These valuable logs give new insights into the activities that are performed using the Graph API in your tenant, which makes it a table you definitly want to explore in the upcoming weeks. The GraphApiAuditEvents table is the ‘free’ version of the MicrosoftGraphActivityLogs table that was available in Sentinel. The GraphApiAuditEvents enables more organizations to use these valuable logs without burning their budget.

Hunting Through APIs - Logic App Edition

Bert-Jan Pals published on 2025-07-15 included in KQL Sentinel Defender for Endpoint Threat Hunting Defender XDR SOC Automation

Logic Apps allow organizations to easily automate processes, in the last blog the APIs to run KQL are discussed. This blog builds upon the knowledge of the previous blog and explains how the Graph API, Azure Monitor API and Defender ATP API can also be integrated into Logic Apps. If you do not run automation solutions via Logic Apps and Sentinel yet, I highly recommend having a look at the previous blogs and Logic Apps below to get an idea of what the possibilities are.