Advanced hunting (KQL)

Investigating a phishing report with KQL, end to end

The complete Defender Advanced Hunting playbook — 14 queries across every email, identity, endpoint and cloud table, correlated into one timeline, plus a fill-in IR report template.