Matt Zorich • 6/21/2022

KQL lessons learnt from #365daysofKQL

The author reflects on completing a #365daysofKQL challenge, sharing insights gained from writing a hunting query every day for a year. Key lessons include the importance of practice for improving query readability and efficiency, developing repeatable query patterns for different log sources, and safely simulating adversary techniques (like consent phishing) using your own account to generate and test detection alerts. The article provides a practical example of building a KQL query for Azure AD audit logs.

0 comments

#cybersecurity #query language #data analysis