Cyber for all

Stay informed, stay secure, and stay one step ahead of adversaries with KQL

Unlock Different Security Perspectives with Kusto Graph Functions

Bert-Jan Pals published on 2026-04-08 included in KQL Azure Data Explorer Threat Hunting

Last week I noticed the post of John Lambert about a new Kusto operator lift and thought this is something that needs further investigation. The lift operator takes a tabular structure as input and “lifts” the data into a graph for a visual representation. We all know that visualizing data in Graphs is beneficial, as it can give other perspectives to the data and by doing so, allow you to identify new things.

[DxBP] Part 1 - Technical Detection Engineering Best Practices

Bert-Jan Pals published on 2026-02-23 included in KQL Detection Engineering Threat Hunting

Detection engineering is far more than just writing a couple of rules and you are done, it is about building resilient, high quality detections that detect evolving threats. This blog series covers both the technical and process related best practises of detection engineering. These best practices help you to build better custom detections or analytics rules and optimizes the process in which these detections are deployed and analysed. This blog series starts with three parts and will be expanded over time as additional detection best practice blogs are added.

Defender for Endpoint Timeline Internals

Bert-Jan Pals published on 2026-01-26 included in KQL Defender for Endpoint SOC Incident Response

Explore Microsoft Defender for Endpoint timeline internals, OneCyber telemetry, MITRE mapping, and DFIR workflows using exported timeline data, jq and KQL.

Monitor New Actions in Sentinel & Defender XDR (V2)

Bert-Jan Pals published on 2026-01-19 included in KQL Sentinel Automation SOC Defender XDR

Learn how to monitor new actions in Microsoft Sentinel and Defender XDR with KQL, Logic Apps, and Graph API. Automate weekly reports and improve SOC detection engineering.

KQL Sources: 2026 Update

Bert-Jan Pals published on 2026-01-05 included in KQL Sentinel Defender for Endpoint

What started as a single blog in 2023 is now becoming a yearly tradition. Each year, the KQL community expands with new repositories and queries. The list does not cover just security, but also Intune, Entra, and Azure Monitor. This year, an extra step is taken to remove some AI generated slop repositories from the list to share correct example repositories. Happy New Year to all of you! Highlights #100DaysOfKQL Starting the highlights of this year with the #100DaysOfKQL series done by SecurityAura.

GraphApiAuditEvents: The new Graph API Logs

Bert-Jan Pals published on 2025-08-19 included in KQL Detection Engineering Threat Hunting

The new GraphApiAuditEvents table in Advanced Hunting have been in Public Preview since July this year. These valuable logs give new insights into the activities that are performed using the Graph API in your tenant, which makes it a table you definitly want to explore in the upcoming weeks. The GraphApiAuditEvents table is the ‘free’ version of the MicrosoftGraphActivityLogs table that was available in Sentinel. The GraphApiAuditEvents enables more organizations to use these valuable logs without burning their budget.