Concept
A query-based threat hunting capability in Microsoft Defender that lets analysts search raw security data with Kusto Query Language (KQL).
| Type | Concept |
|---|
2026-07-22 · Video on YouTube
Traditional antivirus can no longer keep up with ransomware, phishing and attackers who move quietly between devices. This plain-English episode is for IT admins and business owners who want to understand Microsoft Defender for Endpoint, from EDR and attack…
2025-08-05 · Video on YouTube
Make Microsoft 365 Telemetry Useful: Correlate Entra ID Sign-Ins, Teams Activity, and SharePoint File Operations Most dashboards isolate metrics. Real signal appears when you triangulate Azure AD/Entra sign-ins, Office/M365 audit (SharePoint/Teams), and usage…
Look for spikes in failed or high-risk sign-ins combined with large SharePoint or OneDrive downloads or external shares. The episode provides KQL for Sentinel and Defender Advanced Hunting. · From the episode: Correlate Microsoft 365 Telemetry for Better…
Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.
Nobody has listed this topic yet. Add it to your profile.
Maintained by Mirko Peters (Microsoft MVP) · Last updated:
EN
Deutsch
Español
Français
Italiano
Português
Nederlands
Polski
Bahasa Indonesia
Русский
Українська
العربية
עברית
日本語
한국어