Cyber for all

Stay informed, stay secure, and stay one step ahead of adversaries with KQL

Prioritize Vulnerabilities Using The CISA Known Exploited Vulnerabilities Catalog

Bert-Jan Pals published on 2023-12-21 included in KQL Vulnerability Management Defender for Endpoint

Kusto Query Language (KQL) can be your friend when it comes to prioritizing vulnerabilities, specifically when dealing with critical vulnerabilities from the CISA Known Exploited Vulnerabilities Catalog. This blog will explain what this catalog is and how KQL and/or CISAPy can help you to prioritise the vulnerabilities based on your application stack and needs. Multiple KQL examples are provided which can directly be used in your environment to determine which vulnerabilities from the catalog are still active and how they and new ones can be prioritized.

From Threat Report to (KQL) Hunting Query

Bert-Jan Pals published on 2023-11-29 included in KQL Sentinel Defender for Endpoint Threat Hunting

Threat intelligence reports are an essential source to be able to identify and mitigate security threats. However, the process of converting the information in these reports into actionable queries (such as Kusto Query Language (KQL)) can be challenging. In this blog post, we will explore the steps involved in going from a threat intelligence report to a KQL hunting query. This is done based on two #StopRansomware reports of the joint Cybersecurity Advisory (CSA).

KQL Functions For Network Operations

Bert-Jan Pals published on 2023-11-06 included in KQL Detection Engineering SOC Networking Azure Data Explorer

If you query data that contains IP addresses this blog is something for you! It does not matter if you are a SOC Analyst, Detection Engineer, Network Engineer or a Developer all the logs that you use on a daily basis will contain IP addresses. This can be in Sentinel, Defender For Endpoint, Application Insights, Azure Firewall and many other sources. This blog will discuss some basic network related operations, before diving into useful network related KQL functions.

Incident Response Part 3: Leveraging Live Response

Bert-Jan Pals published on 2023-10-26 included in PowerShell Incident Response Defender for Endpoint

This is it, the last part of the Incident Response series. In the past weeks, insight was given on how KQL can be used to perform incident response, even if the data is not ingested in Sentinel or Microsoft 365 Defender. Part three marks the last part which discusses how you can leverage Live Response, which is available in Defender For Endpoint. The incident response series consists of the following parts:

Incident Response Part 2: What about the other logs?

Bert-Jan Pals published on 2023-10-13 included in KQL Azure Data Explorer PowerShell Incident Response

The second part of the Incident Response series is here! In the last blog, we were lucky enough to have the logs already available in Microsoft 365 Defender or Sentinel. But what could you do if you do not ingest the logs in your SIEM or it is not logged by your EDR? This blog will explain how you can still perform incident response using KQL. Spoiler: Azure Data Explorer is your best friend!

Incident Response Part 1: IR on Microsoft Security Incidents (KQL edition)

Bert-Jan Pals published on 2023-09-29 included in KQL Sentinel Defender for Endpoint Incident Response Defender XDR

It always happens on Friday afternoon, a high severity incident is created just before you want to start your weekend. After you have triaged the incident you suspect that an threat actor gained access to your environment. From that moment questions are starting to pop up in your head; what happened on this device? Are more devices impacted? What do I need to do to contain the incident? Will I be in time for dinner with my wife?