How can I reliably detect new software installations on Windows endpoints?
I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID. They are not hybrid joined or fully Entra…
KQL
What’s the Most Reliable Way to Detect New Software Installations on Windows Endpoints?
I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID, but they are not hybrid joined or fully…
How should I prepare for an L2 Azure support role without getting overwhelmed?
I spent three years in a monitoring role where I watched mainframe systems and reported incidents. I now have an opportunity to move into an L2 Azure position,…
Does Defender for Endpoint support custom inline behavior blocking?
I'm comparing Microsoft Defender for Endpoint with CrowdStrike's Indicators of Attack. Defender has custom detections, but I can't find a way to immediately block a behavior based on…
How Can I Identify Who Installed or Copied an Unauthorized Application?
I'm investigating an unauthorized application on an employee's Windows laptop and need to determine which administrator or help desk technician installed or transferred it. The help desk team…
How to Pull Teams Chat Between Two Users for Legal Investigation?
I'm trying to extract Teams chat conversations between two specific users for a legal investigation, but I'm having difficulty narrowing it down properly. My current KQL query pulls…
How to Query Between Dates Using KQL in Purview?
I'm trying to figure out how to write a KQL query that pulls data from both Microsoft Purview and Defender between two specific dates. It seems straightforward, like…
How can I move my ETL logs from a VM to Azure Storage and use KQL for querying?
Hey everyone! We're making the switch from Azure Function Apps to Azure VMs to handle our ETL processes. Right now, we're just saving our logs locally on the…
Looking for Free Resources to Practice KQL Hands-On
I recently took the SC-200 exam and unfortunately didn't pass. The exam included questions about KQL, and I'd like to get better at it. Most resources I've found…
What Are Some Free or Affordable Tools to Practice KQL?
Hey everyone! I'm looking for some advice on tools I can use to practice KQL (Kusto Query Language) without breaking the bank. I had some experience with KQL…