Skip to Content

KQLSecurity

Identity Threat Hunting: A Modern KQL Approach

Conditional Access

Login Account

KQLSecurity

Identity Threat Hunting: A Modern KQL Approach

Conditional Access

Login Account

Identity Threat Hunting: A Modern KQL Approach

Folder: Playbooks

Conditional Access

Folder: Dashboards

Folder: Query Vault

Folder: Resources

Login Account

Progress

Identity Threat Hunting: A Modern KQL Approach

Complete & Continue Next Lesson Learn More

Introduction to Identity Threat Hunting

3 Lessons

Why Identity is the New Security Perimeter

Overview of Microsoft Security Suite (Entra, Sentinel, Defender)

Role of Threat Hunting in Modern SOCs

Understanding Identity Threats

2 Lessons

Common Identity Attack Vectors

Indicators of Compromise for Identity-Based Attacks

Microsoft Entra and Identity Logs

1 Lesson

Key Log Sources for Identity Threat Hunting

KQL Fundamentals for Identity Hunting

1 Lesson

KQL Syntax and Query Basics

Advanced KQL for Identity Threat Detection

2 Lessons

Correlating Identity Data Across Multiple Sources

Using Joins and Summarize for Complex Queries

Real-Time Alerts and Automation

1 Lesson

Configuring Sentinel Analytics Rules for Identity

Defender for Identity Deep Dive

1 Lesson

Investigating Alerts in Defender for Identity

End-to-End Hunting Scenarios

3 Lessons

Detecting Compromised Accounts in Real Time

Investigating OAuth Abuse and Privilege Escalation

Building a Full Hunting Workflow

Reporting and Continuous Improvement

1 Lesson

Best Practices for Continuous Threat Hunting

Identity Threat Hunting: A Modern KQL Approach

Complete & Continue Next Lesson Learn More

Add a video

Reporting and Continuous Improvement

Best Practices for Continuous Threat Hunting

Complete & Continue Next Lesson Learn More

Your logs deserve better.