Reading · Kusto Insights · RSS Amplifier

Welcome to a new Monthly Update. We will go through some news and the latest queries. The goal is to provide you, the reader, a quick summary of what is going on in the world of KQL including News and Blogs from the Community as well as from Microsoft.

Happy New Year and a secure 2026!

Defender for Office 365 - Anti-spam outbound policy - AutoForwardingMode

By: Alex Verboon [GitHub, LinkedIn]

OfficeActivity
| where Operation == @"Set-HostedOutboundSpamFilterPolicy"
| mv-expand parse_json(Parameters)
| extend Setting = parse_json(Parameters)["Name"]
| extend Configuration = parse_json(Parameters)["Value"]
| where Setting == "AutoForwardingMode"
| extend Description = case(
        Configuration == "Automatic", "System-controlled: Default value. Same as Off — forwarding is disabled.",
        Configuration == "On", "Forwarding is enabled: Automatic external forwarding is allowed and not restricted.",
        Configuration == "Off", "Forwarding is disabled: Automatic external forwarding is blocked and results in an NDR to the sender.",
        "Unknown"
    )
| project TimeGenerated, Setting, Configuration, Description
CloudAppEvents
| where ObjectName == "Set-HostedOutboundSpamFilterPolicy"
| mv-expand parse_json(ActivityObjects)
| where ActivityObjects.Name == 'AutoForwardingMode'
| extend Setting = tostring(ActivityObjects.Name)
| extend Configuration = tostring(ActivityObjects.Value)
| extend Description = case(
        Configuration == "Automatic", "System-controlled: Default value. Same as Off — forwarding is disabled.",
        Configuration == "On", "Forwarding is enabled: Automatic external forwarding is allowed and not restricted.",
        Configuration == "Off", "Forwarding is disabled: Automatic external forwarding is blocked and results in an NDR to the sender.",
        "Unknown"
    )
| project TimeGenerated, Setting,Configuration,Description

Source: GitHub

We've handpicked a few blog posts for their insightful content and relevance, yet we acknowledge the wealth of quality submissions from the KQL community. While we can't feature every post, each contribution is valued and vital to our collective knowledge. Stay inspired and keep sharing your perspectives!

VPN Vulnerabilities and Forensic Log Analysis - Based on extensive research into recent VPN exploitation campaigns, this article provides a structured guide for the forensic investigation of compromised firewall VPN systems.

VPN devices have become primary access points for advanced threat actors, ransomware groups, and intrusion operators. Repeated exploitation of zero-day and n-day vulnerabilities highlights an important shift. Perimeter appliances are no longer just security controls. They are also forensic evidence sources that help identify intrusions early.

Detecting Risky Password Reset Activity in Microsoft Sentinel - Password resets are a normal part of day-to-day life in any environment: users forget credentials, policies enforce rotation, and self-service flows help reduce helpdesk load. But when an account starts generating a burst of reset attempts in a short window, the story often changes from “user convenience” to “identity under active attack”.

In this post I’ll walk through a Microsoft Sentinel analytic rule that uses KQL to detect suspicious patterns of multiple password reset attempts per user.

The Detection & Response Chronicles: Exploring Telegram Abuse - Adversaries utilizing popular messaging apps throughout different attack phases is nothing new. Telegram in particular has constantly been the subject of abuse by multiple threat actors, favored for its anonymity, accessibility, resilience, and operational advantages. Since the beginning of October 2025, NVISO’s Security Operations Center (SOC) has identified four distinct intrusion attempts involving the abuse of Telegram. These incidents prompted us to take a closer look at the various ways adversaries are leveraging Telegram for malicious activity and provide detection and hunting opportunities.

Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture - Recently Microsoft Defender XDR introduced a new table called IdentityAccountInfo, and this one immediately caught my attention. It brings several interesting attributes into Advanced Hunting — including LastPasswordChangeTime and even the Sensitivity classification of an identity.

Microsoft Sentinel Platform: Audit Logs and Where to Find Them - This post explains what platform audit logs are and why they matter for tracking actions like who ran a query, triggered an automation, or changed config settings, giving you accountability and context when you’re troubleshooting or hunting. It also spells out where you can find these logs (think CloudAppEvents via Defender Advanced Hunting or Purview Unified Audit Logs as sources you can bring into a workspace). For anyone building queries or alerts in KQL, having those logs flowing into the right tables means you can slice up usage patterns or spot weird activity without guessing where the signals live.

Enhance Monitoring with Azure Postgres Grafana Dashboard - The blog walks through a new Grafana dashboard built for Azure Database for PostgreSQL, showing you how you can pull key metrics like availability, active connections, CPU use, and storage into a slick visual view instead of staring at raw numbers in logs. It explains how this dashboard ties into Azure Monitor using the Azure Monitor data source so you can actually run queries (yes including Kusto Query Language for logs) right in Grafana and build panels that matter to you. You also get a quick how-to for grabbing the JSON from the Grafana Gallery and importing it so you’re up and running fast. If you’re managing Postgres on Azure and love slicing and dicing data visually before writing alerts or deeper KQL, this is a good piece of the puzzle to plug into your toolkit.

Check out some of the latest queries added to KQLSearch.com:

Text within this block will maintain its original spacing when published