Feb 1 · 3 min read · You have seen this happen: You run a query to track errors over time. Between 14:00 and 16:00, you had zero errors. But when you render the timechart, Kusto draws a straight line connecting the 14:00 point directly to the 16:00 point. The Illusion: I...
Join discussion
Feb 1 · 2 min read · Calculating rolling statistics (like a moving median or the 95th percentile over the last 10 days) used to be a pain in KQL. You either had to perform expensive self-joins or chain multiple prev() functions together, which is ugly and hard to maintai...
Join discussion
Feb 1 · 3 min read · Standard Kusto optimization advice usually stops at "filter by time" and "has_cs". But when you are querying terabytes of data or complex attack paths, "best practices" aren't enough. You need to understand the engine's mechanics. Here are 4 advanced...
Join discussion
Jan 29 · 4 min read · If you’ve spent any time managing eDiscovery in a large organisation, you’ll know that an investigator is only as good as the information they have at the start of a case. In Microsoft Purview, there is a growing challenge that I’ve started calling t...
Join discussion
Jan 29 · 4 min read · If you’ve been working with Microsoft Purview eDiscovery for any length of time, you’ve likely run into a bit of a headache regarding BCC and Distribution List (DL) emails. It’s a common scenario: you
Join discussion
Jan 29 · 4 min read · When performing a search on a specific custodian’s mailbox within Purview, the goal is often to produce a comprehensive record of everything that person sent. However, users frequently have secondary aliases, departmental "Send As" addresses, or lega...
Join discussion
Jan 26 · 6 min read · Link to Challenge: https://kc7cyber.com/challenges/279 my thoughts This was a relatively easy medium-level challenge. I spent much of the time trying to clean up my query results, by adding extra commands and joining tables together. In some cases, I...
Join discussion
Jan 8 · 11 min read · 1. Core Syntax & Advanced Patterns The foundation of every query, including variable management. | (Pipe) Purpose: Passes the result of the previous command to the next command. Example: SecurityEvent | where TimeGenerated > ago(1h) | count le...
Join discussion
Dec 29, 2025 · 3 min read · The Mission: SOC Operations Under Siege The 24-hour "Boss Rush" has reached a fever pitch. The Best Festival Company’s Security Operations Center (SOC) is currently in chaos, with dashboards lighting up with a "digital thunderstorm" of alerts. The Ev...
Join discussionDec 16, 2025 · 17 min read · If you've been following along with our Microsoft Fabric series, you've already learned about the fundamentals of Fabric and why real-time intelligence matters in today's business. If you missed that foundational article, I'd recommend starting there...
Join discussion