Welcome to a new Monthly Update. We will go through some news and the latest queries. The goal is to provide you, the reader, a quick summary of what is going on in the world of KQL including News and Blogs from the Community as well as from Microsoft.
Sentinel Health Scheduled Analytics Rule Runs Anomaly
By: Nate Hutchinson [GitHub, LinkedIn]
// Bar chart showing all MFA types used
SigninLogs
| where AuthenticationRequirement == "multiFactorAuthentication"
| where ResultType == 0
| project AuthenticationDetails
| extend ['MFA Method'] = tostring(parse_json(AuthenticationDetails)[1].authenticationMethod)
| summarize Count=count() by ['MFA Method']
| where ['MFA Method'] != "Previously satisfied" and isnotempty(['MFA Method'])
| sort by Count desc
| render barchart with (title="Types of MFA Methods used")Source: GitHub
We've handpicked a few blog posts for their insightful content and relevance, yet we acknowledge the wealth of quality submissions from the KQL community. While we can't feature every post, each contribution is valued and vital to our collective knowledge. Stay inspired and keep sharing your perspectives!
Threat hunting — Popular process misbehaving - My favorite type of detection rules are the ones that do not rely on any upfront threat intelligence signals. No domains, IPs, commands, patterns. Nothing. Just an idea.
Microsoft Foundry Logging: Entra ID Diagnostic Settings and the Identity Plane - Entra ID diagnostic settings are the foundation for AI Foundry agent logging, not a nice-to-have and not replaceable by Advanced Hunting tables. This post covers what to configure, what each table delivers for security operations, how to correlate identity plane data with Foundry resource logs, and includes KQL detection queries for agentic sign-in activity, agent identity lifecycle events, and cross-table correlation patterns.
Unlock Different Security Perspectives with Kusto Graph Functions - Last week I noticed the post of John Lambert about a new Kusto operator lift and thought this is something that needs further investigation. The lift operator takes a tabular structure as input and "lifts" the data into a graph for a visual representation. We all know that visualizing data in Graphs is beneficial, as it can give other perspectives to the data and by doing so, allow you to identify new things. Within security, we deal with huge volumes of data, thus adding graph views to detection, hunting and response capabilities is a welcome change. With these new Kusto funtions you do not have to write 100s of lines to perform make-graph operations, you simply map what you want in a json and the functions do the job for you.
Microsoft Defender: New Advanced hunting enhancements - Microsoft shipped a fresh batch of Advanced Hunting updates, and it's worth a look if you spend your days writing KQL. You now get KQL-defined result limits, so you have tighter control over how much data your queries return and a smoother experience when you're tuning performance. If you're building detection rules or running ad-hoc investigations, this is one of those small quality-of-life wins that makes your workflow cleaner.
Check out some of the latest queries added to KQLSearch.com:
Benjamin Zulliger - LinkedIn & GitHub:
Sergio Albea - LinkedIn & GitHub:
Detect Potential Malicious Emails Based On InternetMessageId Dates
Detect Microsoft One Time Pass Code Emails Via InternetMessageId Odspnotify Value
Jay Kerai - LinkedIn:
Jose Sebastián Canós - GitHub:
Learn KQL with the Must Learn KQL series and book
KQLQuery.com - Blog posts about KQL and different use cases
KQLSearch.com - Search Engine for KQL Queries
Log Analytics Demo Lab: aka.ms/LADemo
Bert-Jan Pals | Microsoft Security MVP
Blog | Twitter | LinkedIn | GitHub
Ugur Koc | Microsoft Security MVP
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.