KQL
4 articles tagged KQL.
SC-200 Security Operations Analyst Study Guide with KQL Practice
Plan your SC-200 preparation using the October 2026 skills measured: domain weights, a four-week study plan, hands-on labs and KQL practice queries.
Send Entra Sign-in and Audit Logs to Log Analytics for Retention
Route Microsoft Entra sign-in and audit logs to a Log Analytics workspace, set table retention beyond 30 days, and query or restore old data later.
Defender XDR Advanced Hunting KQL Queries for Identity Attacks
Hunt password spray, MFA fatigue and suspicious Entra sign-ins with KQL in Defender XDR advanced hunting, then turn the queries into custom detections.
Investigating AiTM Phishing and Token Theft in Entra Sign-in Logs
Scope an adversary-in-the-middle phishing incident with Entra sign-in logs, ID Protection detections and KQL, then contain it, remove attacker persistence and close the gaps.