KQL Cafe - 26. March 2024

Recording and Presentation

• Recording
• Presentation

Hosts

• Gianni
• Alex

Guests

• Purav Desai

Notes

• A Common KQL Mistake in Threat Hunting and Detection Engineering
• Microsoft Security Exposure Management
• Unraveling the Mysteries of Kusto's Parse-Kv Operator: A Deep Dive

Learning KQL - Exposure Management

https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-exposuregraphnodes-table?view=o365-worldwide https://learn.microsoft.com/en-us/security-exposure-management/schemas-operators

What did you do with KQL this month?

• Microsoft Security Exposure Management - Remote Desktop Protocol (RDP)

• Microsoft Security Exposure Management - Managed Identity

• Microsoft Security Exposure Management – Critical Assets

• Parse Netsh advfirewall commands

• Stream and filter data from Windows DNS servers with the AMA connector