Use an Azure Managed Identity for Fluent Bit’s Azure Data Explorer output plugin on Azure Kubernetes Service https://www.danielstechblog.io/use-an-azure-managed-identity-for-fluent-bits-azure-data-explorer-output-plugin-on-azure-kubernetes-service/ #Azure #AKS #AzureKubernetesService #Kubernetes #AzureDataExplorer #ADX #KQL #FluentBit

Test your Lateral Movement investigation skills!

I have just added a new challenge to my FREE "Hands-On Introduction to KQL for Security Analysis" course!

You can even test your AI agents' skills

#KQL#Kusto#MicrosoftSentinel#MicrosoftDefender

https://academy.bluraven.io/course/introduction-to-kql-for-security-analysis

HAPPY EASTER CAPSTONE!

My KQL courses now include a complete attack scenario to test your skills — end to end.

Hands-on labs
20% OFF for a limited time!
Crack it open

#KQL #Kusto #ThreatHunting #DetectionEngineering #DFIR

https://academy.bluraven.io

NEW UPDATE:

I've added a small challenge to my FREE "Hands-On Introduction to KQL for Security Analysis" course.

More will be coming soon!

#KQL #Kusto #MicrosoftDefender #MicrosoftSentinel

https://academy.bluraven.io/course/introduction-to-kql-for-security-analysis

FREE unlimited lab access to "Introduction to KQL for Security Analysis" course!

Thrilled to announce that my Intro to KQL for Security Analysis lab environment is now completely free with no time restrictions!

https://academy.bluraven.io/course/introduction-to-kql-for-security-analysis

Detect suspicious foci token logins:
The in cluded description includes an explanation what foci tokens are and why a hunt might be useful. Nice work!

https://github.com/HybridBrothers/Hunting-Queries-Detection-Rules/blob/main/Entra%20ID/DetectSuspiciousFociTokenLogins.md
#DFIR #BlueTeam #KQL

Enhance #CopilotStudio with actionable insights! From tracking engagement to identifying bottlenecks, these KQL queries in Azure Application Insights empower your bot to perform at its best. Optimize today for a smarter tomorrow! #KQL #AI #Azure

http://mytrial365.com/2025/03/04/using-kql-for-monitoring-and-optimizing-microsoft-copilot-studio/

If you can completely disable device code flows using Conditional Access, you should do so. If you cannot, at least limit which user IDs can use them. If you allow any users to use device code flows, use the #KQL provided to hunt for abuse.

#cybersecurity #microsoft

From: @fabian_bader
https://infosec.exchange/@fabian_bader/114013896376345681

Hunt for signins using device code flow, requesting the Device Registration Service and registering a new Entra ID device as the result

#DeviceCodeFlow #Entra #Security #KQL

https://github.com/f-bader/AzSentinelQueries/blob/master/Defender%20XDR/SignInWithDeviceCodeFlowFollowedByDeviceRegistration.md

Fall in Love with Threat Hunting, Incident Response, and Detection Engineering using #KQL
Code: VLTN30
Valid until 17.02

https://academy.bluraven.io/

Blog Alert!

Let's dig into #KQL and see some differences with #SQL to learn for the #MicrosoftLearn #DP700 certification

http://sqlreitse.com/2025/01/21/dp-700-certification-process-data-using-kql/

Use Fluent Bit for Kubernetes events gathering on Azure Kubernetes Service https://www.danielstechblog.io/use-fluent-bit-for-kubernetes-events-gathering-on-azure-kubernetes-service/ #Azure #AKS #AzureKubernetesService #Kubernetes #AzureDataExplorer #ADX #KQL #FluentBit

NO-BREAK SPACE unicode characters in the display name are not something your average M365 users use.

So better look into #Teams chat messages from those users.

#SecurityTip #KQL

https://github.com/f-bader/AzSentinelQueries/blob/master/Defender%20XDR/SuspiciousTeamsMessagesBasedOnUnicodeInDisplayName.md

Nice blog post providing insight on using #zeek capabilities in #MDE : https://falconforce.nl/detection-engineering-rabbit-holes-parsing-asn-1-packets-in-kql/ #DFIR #blueteam #KQL

At this year's #DEATHCon I was fortunate enough to present my workshop on #Kusto graph semantics. Now I release it for free to everybody.

#KQL #Security #Kraph

https://cloudbrothers.info/en/workshop-kusto-graph-semantics-explained/

New Fluent Bit Azure Data Explorer output plugin version available https://www.danielstechblog.io/new-fluent-bit-azure-data-explorer-output-plugin-version-available/ #Azure #AKS #AzureKubernetesService #Kubernetes #AzureDataExplorer #ADX #KQL #FluentBit

Last call!

Join us next week at Black Hat Europe #BHEU on 9th-10th in London for our Defending Enterprises - 2024 Edition 2-day training.

Tickets are selling well so you don't want to miss out on festive threat hunting, Christmassy monitoring and jingling alerts!

https://www.blackhat.com/eu-24/training/schedule/index.html#defending-enterprises----edition--39001

You want to learn more about the history of #KQL, Graph semantics, Unified Audit Log, ASN.1 and Threat Hunting? You missed #KustoCon

Then I have good news for you. All sessions are now available on YouTube

https://youtube.com/playlist?list=PL9sQKc0RBCiB73e4q-847W02Rzt3qPzbR&si=idAfhc-3wvacLIb0

Retrieve Kubernetes Pods IP addresses with Fluent Bit https://www.danielstechblog.io/retrieve-kubernetes-pods-ip-addresses-with-fluent-bit/ #Azure #AKS #AzureKubernetesService #Kubernetes #AzureDataExplorer #ADX #KQL #FluentBit

Incident Response and Threat Hunting:
A comprehensive collection of Kusto Query Language (KQL) queries used in detection, threat hunting, that focuses on Detections and Digital Forensics

https://github.com/CodeByHarri/Incident-Response-and-Threat-Hunting