Blog alert!

This time, a way to handle arrays that only have one element in KQL. A follow-up to the previous blog on XML and JSON.

#MicrosoftFabric
#ADX
#Kusto
#KQL
#JSON
#XML
#DataEngineer

http://sqlreitse.com/2026/03/17/microsoft-realtime-intelligence-the-array-that-wasnt/

Blog alert!

A short one this time, on a nice find processen XML data in Realtime Intelligence.

#MicrosoftFabric
#RealtimeIntelligence
#XML
#Kusto
#KQL
#EventHouse

http://sqlreitse.com/2026/03/14/microsoft-fabric-realtime-intelligence-processing-xml-or-are-you/

Microsoft Defender for Endpoint Deep Dive

- Part 1: https://cyberboo.substack.com/p/microsoft-defender-for-endpoint-deep?r=6h4qin

- Part 2: https://cyberboo.substack.com/p/microsoft-defender-for-endpoint-part

- Part 3: https://cyberboo.substack.com/p/microsoft-defender-for-endpoint-part-14d

- Part 4: https://cyberboo.substack.com/p/microsoft-defender-for-endpoint-part-dc3

- Part 5: https://cyberboo.substack.com/p/microsoft-defender-for-endpoint-part-8bb

- Part 6: https://cyberboo.substack.com/p/microsoft-defender-for-endpoint-part-259

#microsoft #defenderforendpoint #kql

🎙️ Avec Yoan Schinck sur le threat hunting en KQL!

Au menu:
• Workshop threat hunting dans Microsoft Sentinel
• Détection d'abus de comptes de service
• Comment créer un homelab avec juste 2 VM et des outils gratuits

Sa philosophie: maîtrisez les concepts, la syntaxe s'apprend ensuite.

🎧 Web: https://polysecure.ca/posts/episode-0x673.html#db0bb2c2
🎧 Spotify: https://open.spotify.com/episode/1jBpkTICSTl60b2T2AMyPA?si=UjbrTZYQSFygVHm68VAWjw
🎧 YouTube: https://youtu.be/xooV2tQ4dy8

#Cybersécurité #ThreatHunting #KQL #SOC

🕵️‍♂️ KQL is both a science and an art.

If you’ve ever felt your Sentinel queries were running slow or costing more than they should, you’re not alone.
This week’s #SentinelSaturdays covers how to write leaner, faster, more efficient KQL queries with practical examples you can use today.

🔗 Read the full walkthrough here: https://marshsecurity.org/sentinel-skills-saturday-edition-one/

Share your comments 👇
What’s YOUR top KQL tip or favourite optimisation trick?

Let’s build a thread of practical advice for the hunting community.
#MicrosoftSentinel #KQL #ThreatHunting #SecurityOperations

How to Use Azure Monitor to Gain Insights and Ensure Application Health

In modern cloud environments, maintaining the health and performance of applications is critical. Azure Monitor provides a full-stack monitoring solution that enables organizations to track metrics, diagnose issues, and gain deep insights into their applications and infrastructure. #azuremonitor #CloudMonitoring #ContainerInsights #devops #kql #loganalytics #sentinel #siem #threatdetection

https://azuretracks.com/?p=2781

Hello tout le monde ! J'ai pu mettre à jour mon repository SOC-Ressources avec pas mal de nouvelles choses 🥳

Cela fait 2 ans que je tente petit à petit de créer une "tour de controle" de l'analyste SOC, avec une liste gratuite, ou n'importe qui pourra trouver des ressources pour investiguer, qualifier et monter en compétence sur ce genre de poste.

https://github.com/DXC-0/SOC-Ressources

Cela s'addresse autant aux nouveaux, qu'à des plus confirmés. N'hésitez pas à partager en masse, c'est le but et à me faire des retours, c'est toujours avec plaisir que j'écouterai les améliorations possibles. 😁

Si vous avez des outils que vous souhaitez lister dedans, pareil, je suis preneur.

Sur ce, bon week-end 🎩

------------------------------------------------------------------------

Hello, everybody! I have been able to update my SOC-Resources repository with a lot of new things.

I am gradually trying to create a "Control Tower" of the SOC analyst, with a free list, or anyone will be able to find resources to investigate, qualify and improve Skills

This applies as much to the new, as to the more confirmed. Don't hesitate to share in mass, that's the goal and to make feedback, it's always with pleasure that I will listen to the possible improvements.

#Github #SOC #SOCAnalyst #BlueTeam #Ressources #Free #Ressources #Cybersécurity #Tools #Courses #Malwares #Reverse #Engineer #IT #SIEM #EDR #AQL #SPL #KQL #Hunting #ThreatHunting #IOC #CTI #intelligence

#KQL query that looks for network connections to these domains via #MDE DeviceNetworkEvents (Connection or DNS Query).

https://github.com/SecurityAura/DE-TH-Aura/blob/main/Defender%20for%20Endpoint/ExternalData%20-%20Network%20Connection%20to%20Tycoon2FA%20Domain.md

Huge thanks to @racwatchin8872 for making the data available in a way that can be accessed via externaldata 🙏