List Guest Users with Azure Active Directory Roles
Description This KQL query can be used to display all Guest users in the tenant who have Azure Active Directory
Read MoreWhere Every Failure Becomes A Manual
Description This KQL query can be used to display all Guest users in the tenant who have Azure Active Directory
Read MoreDescription This KQL query lists the incidents that are automatically closed by Microsoft Defender XDR. It is good practice to
Read MoreDescription This KQL query detects successful sign-ins from countries that have not been seen before. Depending on where you run
Read MorePowerShell can be used encoded to obfuscate the commands that have been executed. An attacker can choose encoding to hide
Read MoreThis Threat Hunting case is based on the DeviceNetworkEvents table. The goal is to find malicious HTTP traffic. Step 1:
Read MoreDescription This KQL query identifies the users that are currently at risk. Based on that it performs a lookup on
Read MoreDescription This KQL query can be used to detect rare operating systems that are used to sign into your tenant.
Read MoreDescription This KQL query lists all the different browsers that are used to successfully sign in to your Entra ID
Read MoreDescription The results of this KQL query provide the total number of incidents that have been triggered in your selected timeframe.
Read More