Must Learn KQL Part 13: The Extend Operator

This post is part of an ongoing series to educate about the simplicity and power of the Kusto Query Language (KQL). If you’d like the 90-second post-commercial recap that seems to be a standard part of every TV show these days… The full series index (including code and queries) is located here: https://aka.ms/MustLearnKQL The book … Continue reading Must Learn KQL Part 13: The Extend Operator

KQL Basics and Advanced KQL Hunting for Microsoft 365 Defender

Since it seems I've become all things KQL for our security platforms (which I don't mind at all, btw), I thought I'd step outside the Sentinel realm for a moment and share some recent releases for using KQL with Microsoft 365 Defender. Here's some awesome video content learning... M365D KQL Basics: https://cda.ms/3D3 M365D Advanced Hunting: … Continue reading KQL Basics and Advanced KQL Hunting for Microsoft 365 Defender

“Server error Category A is not supported” message when enabling Microsoft Defender for Office 365 in the Microsoft Sentinel Connector

Recently, a few of us were confused about an error message that exhibited itself when attempting to enable the Microsoft Defender for Office 365 option in the Microsoft 365 Defender connector for Microsoft Sentinel. Never experiencing something like this yourself, makes it even more difficult to troubleshoot. You know the scenario - user or customer … Continue reading “Server error Category A is not supported” message when enabling Microsoft Defender for Office 365 in the Microsoft Sentinel Connector

Must Learn KQL Part 11: The Summarize Operator

This post is part of an ongoing series to educate about the simplicity and power of the Kusto Query Language (KQL). If you’d like the 90-second post-commercial recap that seems to be a standard part of every TV show these days… The full series index (including code and queries) is located here: https://aka.ms/MustLearnKQL The book … Continue reading Must Learn KQL Part 11: The Summarize Operator

New Year’s Resolution: Must Learn KQL in 2022

For those that missed the notification, I'm still off of work until the first week of January. But I'm finding that I truly am a victim of tech FOMO. It's really hard for me to completely shut down and walk away. But this isn't a new phenomenon. I've experienced this my whole professional, adult life. … Continue reading New Year’s Resolution: Must Learn KQL in 2022

Must Learn KQL Part 10: The Count Operator

This post is part of an ongoing series to educate about the simplicity and power of the Kusto Query Language (KQL). If you’d like the 90-second post-commercial recap that seems to be a standard part of every TV show these days… The full series index (including code and queries) is located here: https://aka.ms/MustLearnKQL The book … Continue reading Must Learn KQL Part 10: The Count Operator

Must Learn KQL Part 9: The Limit and Take Operators

This post is part of an ongoing series to educate about the simplicity and power of the Kusto Query Language (KQL). If you’d like the 90-second post-commercial recap that seems to be a standard part of every TV show these days… The full series index (including code and queries) is located here: https://aka.ms/MustLearnKQL The book … Continue reading Must Learn KQL Part 9: The Limit and Take Operators