Welcome to a new Monthly Update. We will go through some news and the latest queries. The goal is to provide you, the reader, a quick summary of what is going on in the world of KQL including News and Blogs from the Community as well as from Microsoft.
KustoCon 2025 is this week! The KQL Conference of the year is taking place this week in Zurich. Join the sessions of some of the best KQL experts out there! The event is held on November 6th, and the online sessions can be followed remotely and are completely free of charge!
🗓️ Sessions & timetable: https://kustocon.com/sessions/
📺 The online sessions can be followed via a live stream and are completely free of charge! Registration: https://www.meetup.com/kql-cafe/events/308087398/
Audit When PIM Fails To Remove An Eligible Member From Role
By: Jay Kerai [GitHub, LinkedIn]
//Original Source: https://azurewithtom.com/posts/MSRC-Case-When-Temporary-Global-Admin-Rights-Don-t-Expire-in-Microsoft-Entra-PIM/
AuditLogs
| where TimeGenerated >= ago(90d)
| where OperationName == “Remove eligible member from role in PIM completed (timebound)”
| where Result == “failure”
| where ResultReason contains “CannotDeleteLastAdminAssignment”
| extend
TargetUser = tostring(TargetResources[2].userPrincipalName),
RoleName = tostring(TargetResources[0].displayName)
//| where RoleName == “Global Administrator” //if you want scope to only GA as per the original article
| project
TimeGenerated,
OperationName,
TargetUser,
RoleName,
ResultReason,
CorrelationId
| sort by TimeGenerated desc
//Always maintain a breakglass. see my article on breakglass guidance here https://www.linkedin.com/pulse/main-reason-you-shouldnt-exclude-break-glass-group-access-kerai-4dtve/Source: GitHub
We've handpicked a few blog posts for their insightful content and relevance, yet we acknowledge the wealth of quality submissions from the KQL community. While we can't feature every post, each contribution is valued and vital to our collective knowledge. Stay inspired and keep sharing your perspectives!
Exploring KQL: External Data Integration and Custom IOC Matching for Enhanced Threat Intelligence - In the world of data analytics and cybersecurity, Kusto Query Language (KQL) stands out as a powerful tool for querying large datasets in platforms like Azure Data Explorer and Microsoft Sentinel. While KQL excels at handling ingested logs and telemetry, integrating external data sources opens up new possibilities for real-time enrichment—particularly in threat hunting scenarios. This blog post dives into two key features: the externaldata operator for pulling in data from external storage like CSV or JSON files in Azure Blobs, and dynamic lookups using the lookup operator for matching against custom Indicators of Compromise (IOCs).
Conditional Access Essentials: From Report-Only to Enforced Mode - Welcome to the final part of my Conditional Access Essentials series! By now, you have your policies defined – great - but how do you safely move from report-only mode to full enforcement? And how do you monitor their impact along the way?
Conditional Access is powerful, but it’s also risky. Misconfigurations can lock users out of critical apps, and even put privileged accounts at risk of losing access to your tenant entirely. That’s why testing, monitoring, and staged rollouts are essential before hitting “enforce.”
Custom detections are now the unified experience for creating detections in Microsoft Defender - This blog post explains that custom detections are now the main way to create and manage detection rules across both Microsoft Sentinel and Microsoft Defender XDR. It highlights that you get a unified interface, can combine data from multiple sources without extra ingestion cost, and use new hunting functions like FileProfile() or DeviceFromIP() while triggering remediation automatically. If you write KQL queries, this is a big deal because you can build rules that cover more data and go beyond simple alerting. It’s a strong signal that the future of detection management is moving toward this unified experience.
6 truths about migrating Microsoft Sentinel to the Defender portal - This blog post explains six important changes to expect as Microsoft Sentinel moves from the Azure portal to the Defender portal by July 2026. If you use KQL, it’s worth noting that incident correlation, automation triggers, and schema fields will shift, so your analytics and playbooks might need updates. It also points out that workspace roles and permissions are evolving, meaning any queries tied to role-based access should be reviewed. Overall, it’s a solid heads-up to get your Kusto work ready before the transition.
Detecting and Alerting on MDE Sensor Health Transitions Using KQL and Logic Apps - This blog post shows how to use KQL and Logic Apps to detect when a Microsoft Defender for Endpoint sensor goes from Active to Inactive and automatically trigger alerts. It uses the DeviceInfo table with a smart prev() example that checks for state changes over time. If you work with Kusto, you’ll like how it connects query logic with real automation instead of stopping at analytics. It’s a great example of turning KQL insights into hands-on operational value.
Check out some of the latest queries added to KQLSearch.com:
Text within this block will maintain its original spacing when published
Robbe Van den Daele - LinkedIn & GitHub:
Text within this block will maintain its original spacing when published
Jose Sebastián Canós - X & GitHub:
Text within this block will maintain its original spacing when published
Jay Kerai - LinkedIn & GitHub:
Text within this block will maintain its original spacing when published
Sergio Albea - LinkedIn & GitHub:
Learn KQL with the Must Learn KQL series and book
KQLQuery.com - Blog posts about KQL and different use cases
KQLSearch.com - Search Engine for KQL Queries
Log Analytics Demo Lab: aka.ms/LADemo
Bert-Jan Pals | Microsoft Security MVP
Blog | Twitter | LinkedIn | GitHub
Ugur Koc | Microsoft Security MVP
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.