KQL Cafe - 31. February 2024

Recording and Presentation

• Recording
• Presentation

Hosts

• Gianni
• Alex

Guests

• Ilana Waitser
• Elyran Malka

News

• The Definitive Guide to KQL: Using Kusto Query Language for Operations, Defending, and Threat Hunting
• K7Cyber
• KQL Security Sources - 2024 Update
• A Deep Dive into the KQL Union Operator
• Extracting Nested Fields in Kusto
• Harnessing threat intelligence using externaldata operator
• Query data in Azure Monitor using Azure Data Explorer

Learn

• What are SIGMA Rules
• Converting Sigma to KQL Online
• Sigma to KQL Backend

What did you do with KQL this month?

• Microsoft Defender for Endpoint – Streamlined Connectivity Monitoring
• Microsoft Defender XDR – Threat Protection Reporting
• Detecting Defender 365 Forwarding Rules policy changes
• HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks