cybersecurity / soc analyst
Advanced KQL for Microsoft Sentinel
Module Progress
3 / 10
Initialize Transmission
4K Cinematic Stream Ready
Mission Intelligence
Master Kusto Query Language (KQL) for threat hunting in Azure logs.
Operational Objectives
- 01Write a KQL join for SigninLogs and AuditLogs.
- 02Create an analytic rule for brute force.
- 03Hunt for anomalies in OfficeActivity.
- 04Use 'summarize' for count by IP.
- 05Filter by 'ResultType == 0'.
Secure Workstation Instance
SYSTEM BOOT: SUCCESSFUL
ENCRYPTION: AES-256-GCM ACTIVE
USER: root@iset-sandbox
Welcome to the iSET+ interactive terminal.
Type 'help' to see available commands.
➜~
➜~