#kql
🚀 Premier meetup de la saison MSDEVMTL demain soir !

On dévoile le programme de l'année, puis Tyler Green et Kevin Mudiandambo (Tilt) présentent leur approche de la télémétrie .NET : App Insights, KQL, alertes et IA.

🗓️ Mar. 29 sept., 18 h · McGill
🗣️ En français

www.meetup.com/msdevmtl/eve...
La télémetrie chez Tilt, Tue, Sep 29, 2026, 6:00 PM | Meetup
La télémétrie chez Tilt Comment savoir ce qui se passe réellement dans votre application une fois qu'elle est en production ? Dans cette présentation, nous partagerons not
www.meetup.com
September 28, 2026 at 3:37 PM
Hunting Invisible Unicode in Emails (+ KQL Queries)
Hunting Invisible Unicode in Emails (+ KQL Queries)
detect.fyi
September 27, 2026 at 12:24 PM
Hunting Invisible Unicode in Emails (+ KQL Queries) https://packetstorm.news/news/view/43987 #news
September 24, 2026 at 8:01 PM
𝗪𝗵𝗮𝘁 𝗛𝗮𝗽𝗽𝗲𝗻𝘀 𝗪𝗵𝗲𝗻 𝗬𝗼𝘂 𝗣𝘂𝘁 𝗮𝗻 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁 𝗼𝗻 𝗕𝗖 𝗧𝗲𝗹𝗲𝗺𝗲𝘁𝗿𝘆? by waldo

#BCTechDays 2026 session recording now released!

What if an AI agent could investigate your BC telemetry, figure out the right events, generate the KQL and help explain what’s going wrong?

📺 Now available for everyone on mibuso.tv
September 24, 2026 at 6:00 AM
Ze zijn niet, ik herhaal n i e t goed in PR jom…

youtu.be/KQL-h9I9uxI?...
September 21, 2026 at 1:34 PM
Kusto-loco 1.4.9 now released. Lokqldx now supports KQL formatting. geo_info_from_ip_address now supports IPV6 lookup. Also fixed an annoying bug with float parsing in some locales. Download: github.com/NeilMacMulle...
Release v1.4.9 · NeilMacMullen/kusto-loco
Core Implement with_index in mv-expand Add IPV6 support for geo_info_from_ip_address @akefallonitis fix issue with parsing real literals in non-english cultures Lokqldx Allow up/down arrow to s...
github.com
September 20, 2026 at 6:19 PM
MotoGP : Márquez révèle ce qui lui a coûté le podium en Autriche
➡️ https://l.auto-moto.com/kQl
September 20, 2026 at 5:59 PM
Hunt Kubernetes Privilege Escalation With KQL: How do you confirm a Kubernetes privilege escalation actually happened? Hunt across control plane and data plane signals in Microsoft Defender for Cloud using two tables — CloudProcessEvents for… MSFTMechanics #Kubernetes #CloudSecurity #CyberSecurity
Hunt Kubernetes Privilege Escalation With KQL
How do you confirm a Kubernetes privilege escalation actually happened? Hunt across control plane and data plane signals in Microsoft Defender for Cloud using two tables — CloudProcessEvents for runtime activity and CloudAuditEvents for control plane actions. A quick KQL query on the audit events surfaces the creation of a cluster-admin role binding and its subject, confirming the attacker granted full admin access to the cluster. ▶ Full episode: https://youtu.be/CnqmC-CQs48 ▶ Get started: https://aka.ms/DefenderCloudSecurity #Shorts #DefenderForCloud #Kubernetes #ContainerSecurity #MicrosoftSecurity
www.youtube.com
September 17, 2026 at 3:21 PM
Comme l’exercice précédent, le staff de l’USON fait confiance à ses jeunes cette saison.
➡️ https://l.lejdc.fr/kqL
September 17, 2026 at 5:06 AM
Des travaux nocturnes sont en cours sur deux giratoires ➡️ https://l.lechorepublicain.fr/kqL
September 16, 2026 at 4:25 PM
KQL Detection of the Week: The Stage Is Not the Chain
https://go.rodtrent.com/go/pqn8e86
September 16, 2026 at 12:00 PM
Threat Hunting with JA4/JA4S (+ Practical KQL Queries)
Threat Hunting with JA4/JA4S (+ Practical KQL Queries)
detect.fyi
September 15, 2026 at 5:24 AM
For a Sentinel role, I might lead with KQL and cloud investigations.

For detection engineering, I might surface Sigma validation, SPL and coverage gaps.

Different roles require different evidence.
September 12, 2026 at 7:00 PM
My investigation skills:

SIEM analysis
SPL and KQL
Alert triage
Hypothesis testing
Timeline building
Incident scoping
MITRE ATT&CK

I’m practising how to connect separate events until they form a defensible conclusion.
September 11, 2026 at 4:18 PM
⚡ Identity is the new perimeter.

Attackers no longer need to breach the network.
They just log into Okta or Entra ID.

Golden SAML • AiTM (Evilginx3) • OAuth Illicit Consent

Full technical analysis + hardening & detection (SPL + KQL):

#IdPAttacks #Okta #EntraID #GoldenSAML #CyberSecurity
September 10, 2026 at 3:20 PM
Fabric RTI 101: KQL materialized views

blog.greglow.com/2026/09/10/f...
September 10, 2026 at 5:00 AM
Les femmes perdent jusqu’à 70 % de leur revenu l’année de la naissance d’un enfant, alerte le Haut Conseil à l’Égalité

➡️ https://l.humanite.fr/kQL
September 9, 2026 at 11:30 AM
adx-mcp-server 1.1.0 KQL Injection https://packetstorm.news/files/230798 #exploit
September 8, 2026 at 10:26 PM
Defending Microsoft Entra ID

4-hour hands-on workshop covering common attacks, tokens, Conditional Access, and real KQL hunting.
Device code phishing • AiTM • refresh token replay — and how to detect them.
With Ethan Bowen.

#EntraID #CloudIdentity #SOC
September 7, 2026 at 8:06 AM
New Entra ID persistence trick: attackers modify dynamic group rules to auto-add users. This KQL watches AuditLogs for GroupMembershipRule changes, isolating admin updates to spot backdoor creation. Deploy it in Sentinel now: https://www.valtersit.com/vault/detecting-persistence-
September 7, 2026 at 7:00 AM
Kusto-loco 1.4.8 now released with lots of new security-related/defender KQL functions thanks to akefallonitis..

Download from: github.com/NeilMacMulle...
September 6, 2026 at 5:03 PM
Detect Entra ID persistence backdoors by auditing GroupMembershipRule modifications in Azure AD AuditLogs with Microsoft Sentinel. #kql #entra-id #ValtersIT

https://www.valtersit.com/vault/detecting-persistence-via-new-azure-ad-dynamic-group-rule-mo-9fef0c/
September 5, 2026 at 1:21 PM
Glad it resonated! 🛡️ Automation is a total game-changer for avoiding burnout and leveling up. Are you looking into KQL or Python first? Happy to point you toward some solid resources to get started!
September 4, 2026 at 8:30 PM