ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Academy • Learn KQL • Microsoft Defender XDR

Agent Foskett Academy

Learn practical Microsoft security through over 300 published lessons covering KQL, Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Defender for Endpoint, Microsoft Defender for Cloud and Microsoft Security Copilot — now joined by the 100-lesson SOC Analyst Academy, with 21 lessons already published. Modules 1 and 2 are complete and Module 3: Identity Incidents is underway. The KQL Academy has now reached Lesson 170, progressing from foundations and investigation workflows into complete identity, endpoint and cloud investigations, proactive threat hunting and advanced detection engineering.

Explore the Academy Investigation Hub
Agent Foskett Academy Microsoft security learning paths
Practical Microsoft security training

Start with KQL foundations, step into the SOC Analyst Academy with 21 published lessons, or choose a dedicated academy for Sentinel, Entra ID, Defender for Endpoint, Defender for Cloud or Microsoft Security Copilot.

More than 300 published lessons + 21 SOC Analyst lessons
Technology + SOC analyst learning paths
Real investigation workflows
🧠 Learn the platform. Follow the evidence.
Build practical skills across Microsoft security operations, identity, endpoint and cloud protection through structured, investigation-led lessons.
Contact GEMXIT →
🔎 SOC Analyst Academy — 21 Lessons Published
Step into the analyst's chair with a complete 100-lesson roadmap covering alert triage, incident investigation, identity, endpoint, email and cloud incidents, containment, escalation, threat hunting and detection engineering. Twenty-one lessons are now published, with Modules 1 and 2 complete and Module 3: Identity Incidents underway.
Open SOC Analyst Academy →
Agent Foskett Investigates Microsoft Security book cover
Amazon Pre-Order Now Live

Take the Academy Mindset Into the Investigation

Agent Foskett Investigates Microsoft Security is officially scheduled for release on 1 September 2026, with Kindle, paperback and hardcover editions.

The book brings the skills taught throughout the Academy into 30 real-world investigations using Microsoft Defender XDR, Microsoft Sentinel, KQL and Microsoft Security Copilot.

Follow the evidence across identity, email, endpoint and cloud telemetry, build defensible timelines and see how the investigator mindset turns individual security events into a complete story.

Releases 1 September 2026 Kindle Paperback Hardcover 30 Investigations By Jonathan Foskett

Explore the Agent Foskett Academy structure

Choose a dedicated Microsoft security academy, continue through the SOC Analyst Academy with 21 published lessons, or work through the original KQL learning path below. Existing lesson tiles and URLs remain preserved, while Sentinel, Entra ID, Defender for Endpoint, Defender for Cloud, Microsoft Security Copilot and SOC Analyst training all have dedicated learning hubs.
Live now • 170 lessons
KQL Academy Start the complete KQL learning path covering foundations, Defender XDR telemetry, hunting playbooks, incident response, advanced enterprise hunting, complete identity, endpoint and cloud investigations, and the new Detection Engineering & Proactive Threat Hunting module.
Live now • 21 of 100 lessons published
SOC Analyst Academy Learn the job of a Microsoft security analyst through realistic scenarios covering alert triage, incident investigation, identity, endpoint, email, cloud, containment, escalation, threat hunting and detection engineering.
Live now
Microsoft Sentinel Academy Learn Sentinel concepts, SIEM, SOAR, Defender XDR integration, Log Analytics workspaces, data connectors, analytics rules, automation, hunting, watchlists and workbooks.
Live now
Microsoft Entra Security Academy Explore identity security, Conditional Access, Identity Protection, PIM, authentication methods, risky sign-ins and identity investigations.
Live now
Defender for Endpoint Academy Build skills across endpoint investigations, device telemetry, attack surface reduction, TVM, Live Response, indicators and EDR workflows.
Live now
Defender for Cloud Academy Learn cloud security posture management, workload protection, recommendations, secure score, Azure security and cloud attack investigation concepts.
Live now • 40-lesson roadmap
Microsoft Security Copilot Academy Learn AI-assisted security operations through prompts, grounding, plugins, permissions, incident summaries, KQL support, threat intelligence, promptbooks, governance and SOC investigation workflows. Lessons 1 and 2 are available now.
Existing KQL lesson URLs have not been moved. The dedicated academy hubs provide a clearer structure while preserving bookmarks, internal links and search visibility across the original lesson catalogue. Security Copilot lessons remain in /agent_foskett/security-copilot, while the SOC Analyst Academy is available at /agent_foskett/soc-analyst with 21 lessons currently published.

What is Agent Foskett Academy?

Agent Foskett Academy is a practical Microsoft security learning platform covering query skills, SOC analyst operations, identity, endpoint, cloud protection and AI-assisted investigation. The aim is simple: help defenders understand the technology, ask better questions and follow evidence through real investigation workflows.
Built for real investigations The lessons connect KQL syntax to real security questions across email, identity, endpoint and cloud telemetry.
Beginner friendly Start with the basics: tables, filters, timestamps, columns and reading your first KQL query without getting overwhelmed.
Investigator mindset The goal is not only to learn commands. The goal is to understand what the data is trying to tell you.
🔍

Browse the Academy by learning path

The Agent Foskett Academy now contains over 300 published lessons across KQL, Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Defender for Endpoint, Microsoft Defender for Cloud and Microsoft Security Copilot, plus the 100-lesson SOC Analyst Academy with 21 lessons already published. Modules 1 and 2 are complete and Module 3: Identity Incidents is underway. The KQL Academy itself has reached Lesson 170, with advanced Identity, Endpoint, Cloud & SaaS Investigation and Detection Engineering & Proactive Threat Hunting modules complete.
Lessons 1–11
Foundations Start with KQL basics, Microsoft security tables, filtering, sorting, projecting, summarising and building your first investigation workflow.
Lessons 12–17
Investigation Workflow Move from single queries into Defender XDR tables, joins, timelines, reusable evidence and investigation parameters.
Lessons 18–32
KQL Operators & Functions Learn multi-indicator searches, string matching, regex, dynamic JSON, mv-expand, mv-apply, extend, case, iff and data normalisation techniques.
Lessons 33–50
Defender XDR Tables Explore endpoint, identity, alert and behaviour telemetry across Device*, Identity*, AlertInfo and AlertEvidence, then connect Defender XDR evidence with Sentinel incident data.
Lessons 51–72
Email Security Investigations Investigate NetworkMessageId, authentication results, sender fields, delivery outcomes, ThreatTypes, BCL, recipients and message identifiers.
Lessons 73–80
URL Clicks & Phishing Correlation Work through UrlClickEvents, URL chains, click-through behaviour and end-to-end phishing investigations across email, endpoint and network telemetry.
Lessons 81–90
Attack Scenarios Apply telemetry to lateral movement, PowerShell abuse, ransomware behaviour, LOLBins, credential theft, persistence, IOC hunts and Business Email Compromise investigations.
Lessons 91–100
Advanced Hunting Techniques Master advanced joins, reusable hunting queries, performance tuning, arg_max(), make_set(), mv-expand, mv-apply and regular expressions.
Lessons 101–110
Hunting Playbook Series Apply KQL and Defender XDR telemetry to real-world attack behaviours including impossible travel, credential theft, OAuth abuse, PowerShell, LOLBins, persistence and ransomware.
Lessons 111–120
Incident Response Workflows Bring the Academy together with complete analyst workflows for phishing, Business Email Compromise, compromised identities, malware, ransomware and full Microsoft Defender XDR investigations.
Lessons 121–130
Advanced Enterprise KQL Move into advanced joins, reusable functions, performance tuning, regex, time-series analysis, enterprise hunting queries and complete hunting workbooks.
Lessons 131–140
Identity Threat Hunting Investigate suspicious sign-ins, MFA fatigue, authentication-method changes, Conditional Access, privileged role activation, shared IP activity, abnormal sessions and complete identity compromise timelines.
Lessons 141–150
Advanced Endpoint Investigation Follow the endpoint attack chain through suspicious browser-to-PowerShell execution, encoded commands, process trees, file creation, network connections, persistence, credential access and lateral movement.
Lessons 151–160
Advanced Cloud & SaaS Investigation Investigate Microsoft 365 data downloads, geographic anomalies, OAuth consent, application activity, mailbox forwarding, external file sharing and complete cloud compromise timelines.
Lessons 161–170
Advanced Detection Engineering & Proactive Threat Hunting Move from reactive investigation into behaviour-led hunting, environment-wide scoping, reusable detections, false-positive tuning, baselining and higher-confidence detection engineering.

🎓 Academy lessons by learning path

Follow the lessons from start to finish, or jump into the learning path that matches the investigation skill you want to build next.
Learning Path 1 — Foundations KQL basics, Microsoft security tables, filtering, useful columns, sorting, summarising, time patterns, distinct values, top results and combining operators.
Lessons 1–11 Microsoft Defender XDR KQL threat hunting
Lesson 1 — What is KQL? Learn what Kusto Query Language is, where it is used inside Microsoft security platforms and why it matters for investigations.
Lesson 2 — Your First KQL Query Learn how to run your first KQL query, filter telemetry by time and start exploring Microsoft Defender XDR telemetry.
Lesson 3 — Understanding Microsoft Security Tables Learn how EmailEvents, UrlClickEvents, DeviceProcessEvents and DeviceNetworkEvents support Defender XDR investigations, and how SigninLogs extends identity analysis in Microsoft Sentinel and Log Analytics.
Lesson 4 — Filtering KQL Results Learn how to use where, contains, has, == and time filters to reduce noise and focus on suspicious activity inside Microsoft Defender XDR and Sentinel.
Lesson 5 — Choosing Useful Columns Learn how to use project to remove clutter, focus on important evidence and display only the fields that matter during Microsoft security investigations.
Lesson 6 — Sorting and Understanding Results Learn how to use order by, desc and asc to sort Microsoft security telemetry and understand investigation timelines more clearly.
Lesson 7 — Counting and Grouping with summarize Learn how to use summarize, count() and by to count events, group activity and identify patterns across Microsoft Defender XDR and Sentinel telemetry.
Lesson 8 — Finding Time Patterns with bin() Learn how to use bin() in KQL to group Microsoft Defender XDR and Sentinel telemetry into time ranges, helping defenders identify spikes, bursts and suspicious activity patterns.
Lesson 9 — Finding Unique Values with distinct Learn how to use distinct in KQL to identify unique users, IP addresses, domains, devices and suspicious values hidden inside Microsoft Defender XDR and Sentinel telemetry.
Lesson 10 — Using top to Find High-Volume Activity Learn how to use top in KQL to quickly identify the most active users, devices, IP addresses, senders and suspicious activity across Microsoft Defender XDR and Sentinel telemetry.
Lesson 11 — Combining KQL Operators into Investigations Learn how defenders combine where, project, summarize, bin(), distinct, top and order by into practical Microsoft Defender XDR and Sentinel investigation workflows.
Learning Path 2 — Investigation Workflow Core investigation workflows using EmailEvents, UrlClickEvents, joins, timelines, reusable evidence and investigation parameters.
Lessons 12–17 Microsoft Defender XDR KQL threat hunting
Lesson 12 — Investigating EmailEvents in Microsoft Defender XDR Learn how to use EmailEvents to investigate senders, recipients, subjects, delivery actions, NetworkMessageId, AuthenticationDetails and suspicious email activity inside Microsoft Defender XDR.
Lesson 13 — Investigating UrlClickEvents in Microsoft Defender XDR Learn how to use UrlClickEvents to investigate Safe Links clicks, suspicious URLs, user activity, ThreatTypes and phishing behaviour inside Microsoft Defender XDR.
Lesson 14 — Connecting Tables with join Learn how defenders use join to connect users, devices, sign-ins, email events, URL clicks and endpoint activity across multiple Microsoft security tables.
Lesson 15 — Building Investigation Timelines with KQL Learn how defenders build clear investigation timelines by ordering events, comparing timestamps and following activity across Microsoft security telemetry.
Lesson 16 — Using let Statements to Reuse Evidence Learn how defenders use let statements to create reusable evidence sets, keep KQL queries cleaner and build more structured Microsoft Defender XDR investigations.
Lesson 17 — Creating Investigation Parameters Learn how defenders create flexible KQL investigations using reusable parameters for users, devices, IP addresses, domains and time ranges.
Learning Path 3 — KQL Operators & Functions Multi-indicator searching, text matching, regex, parse, dynamic data, mv-expand, mv-apply, extend, case(), iff(), tostring() and text normalisation.
Lessons 18–32 Microsoft Defender XDR KQL threat hunting
Lesson 18 — Using in to Search Multiple Indicators Learn how defenders use the in operator to search for multiple users, IP addresses, devices, domains and other indicators across Microsoft Defender XDR and Sentinel telemetry.
Lesson 19 — Using has_any to Find Suspicious Text Learn how defenders use has_any to search for multiple suspicious words, domains, commands and indicators inside Microsoft Defender XDR and Sentinel telemetry.
Lesson 20 — Using contains_cs for Case-Sensitive Searches Learn how defenders use case-sensitive KQL searches to find exact text matches, suspicious commands, filenames and indicators without creating unnecessary noise.
Lesson 21 — Using startswith and endswith Learn how defenders use startswith and endswith to identify suspicious filenames, domains, email addresses, URLs and command-line activity across Microsoft Defender XDR and Sentinel telemetry.
Lesson 22 — Using matches regex for Pattern Matching Learn how defenders use matches regex to identify suspicious naming conventions, command-line patterns, file paths, domains, URLs and attacker techniques across Microsoft Defender XDR and Sentinel telemetry.
Lesson 23 — Using extract for Flexible Pattern Matching Learn how defenders use flexible pattern matching to extract usernames, domains, URLs, command-line arguments and structured evidence from Microsoft Defender XDR and Sentinel telemetry.
Lesson 24 — Expanding Multi-Value Data with mv-expand Learn how defenders use mv-expand to break apart arrays, lists and dynamic fields, allowing deeper analysis of Microsoft Defender XDR and Sentinel telemetry.
Lesson 25 — Working with Dynamic Data using parse_json() Learn how defenders use parse_json() to access nested values, investigate complex Microsoft Defender XDR telemetry and work with structured security data.
Lesson 26 — Extracting Evidence with extract() Learn how defenders use extract() with regular expressions to pull IP addresses, domains, ticket numbers, identifiers and hidden indicators from Microsoft Defender XDR and Sentinel telemetry.
Lesson 27 — Advanced Multi-Value Investigations with mv-apply Learn how defenders use mv-apply to work with arrays, nested values and multi-value telemetry while keeping investigation context inside Microsoft Defender XDR and Sentinel.
Lesson 28 — Creating New Evidence Fields with extend Learn how defenders use extend to create calculated fields, enrich evidence, normalise values and build more powerful Microsoft Defender XDR and Sentinel investigations.
Lesson 29 — Classifying Evidence with case() Learn how defenders use case() to classify events, label suspicious activity, score evidence and make Microsoft Defender XDR and Sentinel investigation results easier to understand.
Lesson 30 — Adding Conditional Logic with iff() Learn how defenders use iff() to create simple true-or-false investigation labels, flag suspicious activity and make Microsoft Defender XDR and Sentinel results easier to triage.
Lesson 31 — Converting Values with tostring() Learn how defenders use tostring() to convert dynamic values, normalise investigation fields and avoid datatype issues across Microsoft Defender XDR and Sentinel telemetry.
Lesson 32 — Normalising Text with tolower() and toupper() Learn how defenders use tolower() and toupper() to normalise usernames, domains, email addresses, filenames and command-line values before comparing investigation evidence.
Learning Path 4 — Defender XDR Tables Endpoint, identity, alert and behaviour telemetry across Device*, Identity*, AlertInfo and AlertEvidence, with Sentinel incident correlation and timeline investigations.
Lessons 33–50 Microsoft Defender XDR KQL threat hunting
Lesson 33 — Investigating DeviceNetworkEvents in Microsoft Defender XDR Learn how defenders use DeviceNetworkEvents to investigate outbound connections, remote IPs, ports, domains and suspicious network activity inside Microsoft Defender XDR.
Lesson 34 — Investigating DeviceFileEvents in Microsoft Defender XDR Learn how defenders use DeviceFileEvents to investigate file creation, downloads, suspicious archives, scripts, malware payloads and file activity inside Microsoft Defender XDR.
Lesson 35 — Investigating DeviceProcessEvents in Microsoft Defender XDR Learn how defenders use DeviceProcessEvents to investigate process execution, command lines, parent-child relationships, suspicious scripts and endpoint activity inside Microsoft Defender XDR.
Lesson 36 — Investigating DeviceRegistryEvents in Microsoft Defender XDR Learn how defenders use DeviceRegistryEvents to investigate registry changes, persistence techniques, suspicious autoruns and endpoint modification activity inside Microsoft Defender XDR.
Lesson 37 — Investigating IdentityLogonEvents in Microsoft Defender XDR Learn how defenders use IdentityLogonEvents to investigate authentication activity, successful and failed logons, account access patterns, risky sign-ins and identity-based attack activity inside Microsoft Defender XDR.
Lesson 38 — Investigating IdentityDirectoryEvents in Microsoft Defender XDR Learn how defenders use IdentityDirectoryEvents to investigate group membership changes, account modifications, privileged role assignments and directory-based attack activity inside Microsoft Defender XDR.
Lesson 39 — Investigating AlertInfo in Microsoft Defender XDR Learn how defenders use AlertInfo to investigate Microsoft Defender XDR alerts, review alert metadata, severity, categories, detection sources and prioritise suspicious activity for deeper investigation.
Lesson 40 — Investigating AlertEvidence in Microsoft Defender XDR Learn how defenders use AlertEvidence to connect Microsoft Defender XDR alerts to the users, devices, files, processes, IP addresses, URLs and entities involved in an investigation.
Lesson 41 — Investigating DeviceInfo in Microsoft Defender XDR Learn how defenders use DeviceInfo to understand device inventory, operating systems, exposure context, logged-on users and endpoint details before pivoting into process, file, registry and network evidence.
Lesson 42 — Investigating DeviceEvents in Microsoft Defender XDR Learn how defenders use DeviceEvents to investigate additional endpoint activity, security controls, device actions and supporting events that do not always appear in process, file, registry or network tables.
Lesson 43 — Investigating DeviceLogonEvents in Microsoft Defender XDR Learn how defenders use DeviceLogonEvents to investigate local logons, remote interactive logons, failed authentication attempts, account usage and suspicious endpoint sign-in activity.
Lesson 44 — Investigating EmailAttachmentInfo in Microsoft Defender XDR Learn how defenders use EmailAttachmentInfo to investigate attachment names, file hashes, suspicious payloads, malware delivery and email-borne threats inside Microsoft Defender XDR.
Lesson 45 — Investigating EmailUrlInfo in Microsoft Defender XDR Learn how defenders use EmailUrlInfo to investigate URLs embedded in emails, malicious links, phishing campaigns, Safe Links activity and web-based attack techniques inside Microsoft Defender XDR.
Lesson 46 — Investigating CloudAppEvents: The User Passed MFA. The Attacker Still Got In. Learn how defenders use CloudAppEvents to investigate OAuth abuse, mailbox compromise, SharePoint access, OneDrive activity and cloud-based attack techniques inside Microsoft Defender XDR.
Lesson 47 — Investigating IdentityInfo: The Account Looked Normal. The Permissions Didn't. Learn how defenders use IdentityInfo to investigate user accounts, privileged roles, group memberships, departments, managers and identity context during Microsoft Defender XDR investigations.
Lesson 48 — Investigating SecurityIncident: Five Alerts. One Incident. Learn how defenders use SecurityIncident to investigate correlated alerts, incident severity, affected entities, attack timelines and complete attack stories inside Microsoft Defender XDR.
Lesson 49 — Investigating BehaviorEntities: The User Wasn't Suspicious. The Behaviour Was. Learn how defenders use BehaviorEntities to investigate unusual activity, behavioural analytics, risk indicators and suspicious patterns across Microsoft Defender XDR investigations.
Lesson 50 — The Timeline Told The Story Learn how defenders combine email, URL, identity, cloud, alert and incident telemetry to reconstruct a complete Microsoft Defender XDR investigation from initial access through to attacker activity.
Learning Path 5 — Email Security Investigations Email authentication, sender identity, delivery outcomes, ThreatTypes, DetectionMethods, AuthenticationDetails, BCL, recipients, subjects and message identifiers.
Lessons 51–72 Microsoft Defender XDR KQL threat hunting
Lesson 51 — Investigating NetworkMessageId in Microsoft Defender XDR Learn how defenders use NetworkMessageId to connect EmailEvents, UrlClickEvents, EmailAttachmentInfo and EmailUrlInfo together, allowing complete email investigations across Microsoft Defender XDR.
Lesson 52 — Investigating EmailAuthenticationResults in Microsoft Defender XDR Learn how defenders use EmailAuthenticationResults to investigate SPF, DKIM, DMARC and composite authentication outcomes, helping identify phishing, spoofing and email impersonation attacks in Microsoft Defender XDR.
Lesson 53 — Investigating SenderFromAddress vs SenderMailFromAddress in Microsoft Defender XDR Learn how defenders compare SenderFromAddress and SenderMailFromAddress to identify spoofing, phishing, impersonation attempts and misleading sender information during Microsoft Defender XDR investigations.
Lesson 54 — Investigating DeliveryLocation in Microsoft Defender XDR Learn how defenders use DeliveryLocation to determine whether messages reached the inbox, junk folder, quarantine, deleted items or another destination during Microsoft Defender XDR email investigations.
Lesson 55 — Investigating DeliveryAction in Microsoft Defender XDR Learn how defenders use DeliveryAction to understand what Microsoft 365 actually did with an email, including delivered, blocked, quarantined, redirected and other mail flow actions during Microsoft Defender XDR investigations.
Lesson 56 — Investigating ThreatTypes in Microsoft Defender XDR Learn how defenders use ThreatTypes to understand whether Microsoft classified messages as phishing, malware, spam, spoofing, bulk mail or other email threats during Microsoft Defender XDR investigations.
Lesson 57 — Investigating DetectionMethods in Microsoft Defender XDR Learn how defenders use DetectionMethods to understand how Microsoft identified, analysed and classified email threats, helping explain why messages were flagged as phishing, malware, spoofing, spam or other suspicious activity during Microsoft Defender XDR investigations.
Lesson 58 — Investigating EmailDirection in Microsoft Defender XDR Learn how defenders use EmailDirection to determine whether messages were inbound, outbound or internal, helping investigators understand attack paths, user activity, mail flow behaviour and potential security incidents during Microsoft Defender XDR investigations.
Lesson 59 — Investigating OrgLevelAction in Microsoft Defender XDR Learn how defenders use OrgLevelAction to understand what action Microsoft 365 organisational policies applied to suspicious email messages, helping explain whether messages were delivered, blocked, quarantined, redirected or otherwise handled during Microsoft Defender XDR investigations.
Lesson 60 — Investigating AuthenticationDetails in Microsoft Defender XDR Learn how defenders use AuthenticationDetails to investigate SPF, DKIM, DMARC and composite authentication results, helping determine whether email messages were genuinely sent from trusted domains or potentially involved spoofing, impersonation or phishing activity during Microsoft Defender XDR investigations.
Lesson 61 — Investigating SenderIPv4 in Microsoft Defender XDR Learn how defenders use SenderIPv4 to identify the originating IP address behind email messages, helping investigate phishing campaigns, spoofing attempts, suspicious infrastructure, sender reputation and malicious email activity during Microsoft Defender XDR investigations.
Lesson 62 — Investigating SenderIPv6 in Microsoft Defender XDR Learn how defenders use SenderIPv6 to identify the originating IPv6 infrastructure behind email messages, helping investigate phishing campaigns, spoofing attempts, sender reputation, suspicious mail servers and malicious email activity during Microsoft Defender XDR investigations.
Lesson 63 — Investigating SenderMailFromAddress in Microsoft Defender XDR Learn how defenders use SenderMailFromAddress to investigate the actual SMTP sender behind email messages, helping identify spoofing attempts, phishing attacks, mail flow anomalies and authentication issues during Microsoft Defender XDR investigations.
Lesson 64 — Investigating SenderMailFromDomain in Microsoft Defender XDR Learn how defenders use SenderMailFromDomain to investigate the SMTP domain used during email delivery, helping identify spoofing attempts, SPF alignment issues, phishing campaigns, domain impersonation and email authentication anomalies during Microsoft Defender XDR investigations.
Lesson 65 — Investigating BulkComplaintLevel (BCL) in Microsoft Defender XDR Learn how defenders use BulkComplaintLevel (BCL) to understand how Microsoft classifies newsletters, marketing campaigns and bulk email, helping investigate email reputation, spam filtering decisions, user complaints and message handling during Microsoft Defender XDR investigations.
Lesson 66 — Investigating CompositeAuthentication in Microsoft Defender XDR Learn how defenders use CompositeAuthentication to understand Microsoft's overall authentication verdict, helping investigate SPF, DKIM, DMARC alignment, spoofing attempts, phishing campaigns and email trust decisions during Microsoft Defender XDR investigations.
Lesson 67 — Investigating RecipientEmailAddress in Microsoft Defender XDR Learn how defenders use RecipientEmailAddress to identify who received suspicious messages, helping investigate phishing campaign reach, targeted users, email delivery activity and message distribution across Microsoft 365 during Microsoft Defender XDR investigations.
Lesson 68 — Investigating SenderFromDomain in Microsoft Defender XDR Learn how defenders use SenderFromDomain to investigate the visible sender domain presented to recipients, helping identify domain impersonation, phishing campaigns, trusted-domain abuse and suspicious email activity during Microsoft Defender XDR investigations.
Lesson 69 — Investigating SenderDisplayName in Microsoft Defender XDR Learn how defenders use SenderDisplayName to investigate display-name impersonation, executive spoofing, business email compromise (BEC), phishing campaigns and deceptive sender identities during Microsoft Defender XDR investigations.
Lesson 70 — Investigating Subject in Microsoft Defender XDR Learn how defenders use Subject to investigate phishing campaigns, malicious lures, invoice fraud, credential harvesting attempts and campaign clustering by analysing email subjects during Microsoft Defender XDR investigations.
Lesson 71 — Investigating InternetMessageId in Microsoft Defender XDR Learn how defenders use InternetMessageId to uniquely identify email messages across Microsoft Defender XDR and Exchange Online, helping correlate phishing reports, trace message delivery and connect related security events during Microsoft 365 investigations.
Lesson 72 — Investigating ReportId in Microsoft Defender XDR Learn how defenders use ReportId to correlate related email events, group investigation evidence and identify activity belonging to the same Microsoft Defender XDR investigation across multiple security tables.
Learning Path 6 — URL Clicks & Phishing Correlation UrlClickEvents, URL chains, click-through behaviour and complete phishing investigations that correlate email, endpoint and network evidence.
Lessons 73–80 Microsoft Defender XDR KQL threat hunting
Lesson 73 — Advanced UrlClickEvents Investigations in Microsoft Defender XDR Learn how defenders perform advanced investigations using UrlClickEvents to determine whether users clicked malicious links, correlate phishing emails, analyse Safe Links activity and build complete investigation timelines during Microsoft Defender XDR investigations.
Lesson 74 — Investigating UrlChain in Microsoft Defender XDR Learn how defenders use UrlChain to trace every redirect from the original clicked link to the final destination, helping uncover phishing infrastructure, malicious redirects and credential harvesting attacks during Microsoft Defender XDR investigations.
Lesson 75 — Investigating IsClickedThrough in Microsoft Defender XDR Learn how defenders use IsClickedThrough to determine whether users continued beyond Microsoft Defender Safe Links protection, helping investigate successful phishing attempts, risky user behaviour and potential credential compromise during Microsoft Defender XDR investigations.
Lesson 76 — Investigating ActionType in UrlClickEvents Learn how defenders use ActionType in UrlClickEvents to understand how Microsoft Defender handled URL clicks, helping investigate blocked, allowed and Safe Links-protected user activity during Microsoft Defender XDR investigations.
Lesson 77 — Correlating EmailEvents and UrlClickEvents in Microsoft Defender XDR Learn how defenders correlate EmailEvents and UrlClickEvents using KQL to build complete phishing investigation timelines, identify affected users, determine who clicked malicious links and understand how Microsoft Defender XDR records email delivery and user interaction.
Lesson 78 — Correlating EmailEvents with DeviceProcessEvents in Microsoft Defender XDR Learn how defenders correlate EmailEvents with DeviceProcessEvents using KQL to determine what executed on a device after a phishing email was delivered or an attachment was opened, helping identify malicious payload execution and endpoint compromise during Microsoft Defender XDR investigations.
Lesson 79 — Correlating EmailEvents with DeviceNetworkEvents in Microsoft Defender XDR Learn how defenders correlate EmailEvents with DeviceNetworkEvents using KQL to determine whether a phishing email resulted in outbound network activity, helping identify malicious domains, command-and-control communication, payload downloads and endpoint compromise during Microsoft Defender XDR investigations.
Lesson 80 — Building a Complete Phishing Investigation in Microsoft Defender XDR Learn how defenders combine EmailEvents, UrlClickEvents, DeviceProcessEvents and DeviceNetworkEvents to reconstruct an end-to-end phishing investigation, following an attack from email delivery through user interaction, endpoint execution and outbound network activity in Microsoft Defender XDR.
Learning Path 7 — Attack Scenarios Lateral movement, PowerShell attacks, ransomware behaviour, LOLBins, device timelines, credential theft, persistence, IOC hunting and BEC investigations.
Lessons 81–90 Microsoft Defender XDR KQL threat hunting
Lesson 81 — Investigating Lateral Movement in Microsoft Defender XDR Learn how defenders investigate lateral movement by tracking logons, remote connections, authentication activity and endpoint evidence to follow an attacker moving through the environment in Microsoft Defender XDR.
Lesson 82 — Investigating PowerShell Attacks in Microsoft Defender XDR Learn how defenders investigate malicious PowerShell activity by identifying encoded commands, suspicious execution, parent processes and endpoint evidence in Microsoft Defender XDR.
Lesson 83 — Investigating Ransomware Behaviour in Microsoft Defender XDR Learn how defenders investigate ransomware behaviour by identifying encryption activity, mass file changes, suspicious processes and attacker techniques in Microsoft Defender XDR.
Lesson 84 — Investigating Living Off The Land (LOLBins) in Microsoft Defender XDR Learn how defenders investigate Living Off The Land (LOLBins) techniques by identifying legitimate Windows tools abused by attackers to execute malicious activity while avoiding detection.
Lesson 85 — Building a Device Timeline in Microsoft Defender XDR Learn how defenders build a complete device timeline by correlating process, network, file and logon activity to reconstruct attacker behaviour in Microsoft Defender XDR.
Lesson 86 — Investigating Credential Theft in Microsoft Defender XDR Learn how defenders investigate credential theft by identifying suspicious authentication activity, stolen credentials and attacker techniques used to gain unauthorised access in Microsoft Defender XDR.
Lesson 87 — Investigating Persistence Techniques in Microsoft Defender XDR Learn how defenders investigate persistence techniques by identifying scheduled tasks, registry changes, services and other attacker methods used to maintain access in Microsoft Defender XDR.
Lesson 88 — Building an IOC Hunt in Microsoft Defender XDR Learn how defenders build an IOC hunt by identifying malicious files, IP addresses, domains, URLs and hashes across the environment using Microsoft Defender XDR.
Lesson 89 — Building an Incident Timeline in Microsoft Defender XDR Learn how defenders build a complete incident timeline by correlating identity, device, email and network activity to reconstruct an attack in Microsoft Defender XDR.
Lesson 90 — Investigating a Business Email Compromise (BEC) in Microsoft Defender XDR Learn how defenders investigate Business Email Compromise (BEC) by correlating email, identity and endpoint activity to uncover attacker actions in Microsoft Defender XDR.
Learning Path 8 — Advanced Hunting Techniques Advanced joins, reusable hunting queries, dynamic JSON, performance optimisation, arg_max(), make_set(), mv-expand, mv-apply, regex and reusable KQL patterns.
Lessons 91–100 Microsoft Defender XDR KQL threat hunting
Lesson 91 — Advanced join Techniques in KQL for Microsoft Defender XDR Learn how defenders use advanced join techniques to correlate data across multiple Microsoft Defender XDR tables and build more powerful threat hunting queries.
Lesson 92 — Using let Statements to Build Reusable Hunting Queries Learn how defenders use let statements in KQL to create reusable variables, simplify complex queries and build more efficient Microsoft Defender XDR threat hunting investigations.
Lesson 93 — Working with Dynamic Data and JSON in KQL Learn how defenders work with dynamic data and JSON in KQL to extract, parse and analyse complex Microsoft Defender XDR telemetry for advanced threat hunting.
Lesson 94 — Optimising KQL Queries for Performance Learn how defenders optimise KQL queries by reducing search scope, filtering efficiently and improving Microsoft Defender XDR threat hunting performance.
Lesson 95 — Using arg_max() in KQL Learn how defenders use arg_max() to return the most recent event in each group, making Microsoft Defender XDR investigations faster, cleaner and easier to interpret.
Lesson 96 — Using make_set() in KQL Learn how defenders use make_set() to build unique collections of users, devices, IP addresses, domains and other indicators, making Microsoft Defender XDR investigations easier to summarise and analyse.
Lesson 97 — Using mv-expand in KQL Learn how defenders use mv-expand to split arrays and multi-value fields into individual records, making Microsoft Defender XDR investigations easier to analyse and uncover hidden evidence.
Lesson 98 — Using mv-apply in KQL Learn how defenders use mv-apply to analyse multi-value fields with greater control, enabling advanced Microsoft Defender XDR threat hunting across arrays, nested objects and complex telemetry.
Lesson 99 — Using Regular Expressions (regex) in KQL Learn how defenders use regular expressions (regex) in KQL to identify suspicious patterns, extract hidden data and perform advanced Microsoft Defender XDR threat hunting across emails, URLs, command lines and log data.
Lesson 100 — Building Reusable Hunting Queries in KQL Learn how defenders build reusable KQL hunting queries using let statements, variables, reusable logic and modular techniques to create faster, more consistent Microsoft Defender XDR investigations.
Learning Path 9 — Hunting Playbook Series Practical Microsoft Defender XDR hunting playbooks for common attacker behaviours, from impossible travel and credential theft through to OAuth abuse, PowerShell, LOLBins, persistence, risky sign-ins, insider threats and ransomware.
Lessons 101–110 Threat hunting Microsoft Defender XDR
Lesson 101 — Hunting Playbook: Impossible Travel Learn how defenders hunt for impossible travel by correlating Microsoft Defender XDR and Microsoft Entra ID sign-in telemetry, IP addresses, locations and authentication activity to determine whether suspicious sign-ins represent legitimate travel or compromised credentials.
Lesson 102 — Hunting Playbook: Credential Theft Learn how defenders hunt for credential theft by analysing suspicious sign-ins, authentication behaviour, token usage, password activity and Microsoft Defender XDR identity telemetry to identify compromised accounts before attackers can move laterally.
Lesson 103 — Hunting Playbook: Malicious Inbox Rules Learn how defenders hunt for malicious inbox rules by investigating Microsoft Defender XDR and Exchange Online telemetry to detect hidden forwarding rules, suspicious mailbox persistence, message redirection and post-compromise attacker activity.
Lesson 104 — Hunting Playbook: OAuth Abuse Learn how defenders hunt for OAuth abuse by investigating suspicious application consent, delegated permissions, token usage, Microsoft Entra ID activity and Microsoft Defender XDR telemetry to detect attackers maintaining persistent access through malicious applications.
Lesson 105 — Hunting Playbook: PowerShell Abuse Learn how defenders hunt for malicious PowerShell activity by analysing Microsoft Defender XDR process events, command-line arguments, encoded commands and script execution to identify attacker reconnaissance, persistence and post-compromise behaviour.
Lesson 106 — Hunting Playbook: LOLBins Learn how defenders hunt for Living Off the Land Binaries by analysing Microsoft Defender XDR process telemetry, parent-child process relationships, command-line activity and legitimate Windows tools being abused for malicious execution, persistence and lateral movement.
Lesson 107 — Hunting Playbook: Persistence Mechanisms Learn how defenders hunt for attacker persistence by analysing Microsoft Defender XDR telemetry to detect scheduled tasks, services, startup folders, registry run keys, WMI event subscriptions and other techniques used to maintain long-term access to compromised systems.
Lesson 108 — Hunting Playbook: Risky Sign-ins Learn how defenders hunt for risky sign-ins by analysing Microsoft Entra ID risk detections, Microsoft Defender XDR identity telemetry, authentication patterns, user behaviour and Conditional Access signals to identify compromised accounts and suspicious access attempts.
Lesson 109 — Hunting Playbook: Insider Threats Learn how defenders hunt for insider threats by analysing Microsoft Defender XDR identity, endpoint and Microsoft 365 telemetry to identify unusual user behaviour, abnormal file access, privileged account misuse, suspicious data movement and indicators of malicious or compromised insider activity.
Lesson 110 — Hunting Playbook: Ransomware Learn how defenders hunt for ransomware by analysing Microsoft Defender XDR endpoint, identity and file telemetry to detect encryption activity, privilege escalation, lateral movement, malicious processes and attacker behaviour before, during and after a ransomware attack.
Learning Path 10 — Incident Response Workflows Complete end-to-end investigation workflows that show how analysts respond to real security incidents, collect evidence, validate user activity, contain threats and close incidents using Microsoft Defender XDR telemetry.
Lessons 111–120 Incident response Analyst workflows
Lesson 111 — Incident Response Workflow: Phishing Investigation Learn how defenders investigate a phishing incident from the initial alert through to containment by analysing Microsoft Defender XDR email, identity, endpoint and Safe Links telemetry to determine delivery, user interaction, compromise and remediation.
Lesson 112 — Incident Response Workflow: Business Email Compromise Learn how defenders investigate a Business Email Compromise (BEC) incident by analysing Microsoft Defender XDR email, identity and mailbox telemetry to identify unauthorised access, fraudulent email activity, mailbox manipulation, financial fraud indicators and post-compromise attacker behaviour.
Lesson 113 — Incident Response Workflow: Compromised User Account Learn how defenders investigate a compromised user account by analysing Microsoft Defender XDR identity, endpoint and cloud telemetry to identify suspicious authentication activity, privilege escalation, attacker persistence, lateral movement and post-compromise behaviour.
Lesson 114 — Incident Response Workflow: Malware Infection Learn how defenders investigate a malware infection by analysing Microsoft Defender XDR endpoint, process, file and network telemetry to identify the initial compromise, malicious execution, persistence mechanisms, lateral movement, attacker activity and effective containment strategies.
Lesson 115 — Incident Response Workflow: Ransomware Incident Learn how defenders investigate a ransomware incident by correlating Microsoft Defender XDR endpoint, identity, file and network telemetry to reconstruct the attack timeline, identify patient zero, determine the blast radius, contain the threat and support recovery activities.
Lesson 116 — Incident Response Workflow: Insider Threat Investigation Learn how defenders investigate a suspected insider threat by analysing Microsoft Defender XDR identity, endpoint, cloud and file telemetry to identify unusual user behaviour, privileged access misuse, abnormal data access, policy violations and potential malicious or compromised insider activity.
Lesson 117 — Incident Response Workflow: Data Exfiltration Learn how defenders investigate suspected data exfiltration by analysing Microsoft Defender XDR endpoint, identity, cloud and network telemetry to identify sensitive data access, large file transfers, cloud uploads, external sharing activity and potential data theft.
Lesson 118 — Incident Response Workflow: OAuth Application Compromise Learn how defenders investigate a malicious OAuth application compromise by analysing Microsoft Defender XDR identity, cloud and Microsoft Entra ID telemetry to identify unauthorised application consent, delegated permissions, token abuse, persistent access and attacker activity across Microsoft 365 services.
Lesson 119 — Incident Response Workflow: Cloud Identity Attack Learn how defenders investigate a cloud identity attack by analysing Microsoft Defender XDR identity, Microsoft Entra ID and cloud telemetry to identify suspicious authentication activity, privilege escalation, token abuse, Conditional Access bypass attempts and attacker movement across Microsoft 365 services.
Lesson 120 — Incident Response Workflow: Full Microsoft Defender XDR Investigation Learn how defenders conduct a complete Microsoft Defender XDR investigation by correlating identity, endpoint, email, cloud and network telemetry to reconstruct the attack timeline, identify the initial compromise, determine the blast radius, contain the threat and document the incident from start to finish.
Learning Path 11 — Advanced Enterprise KQL Advanced joins, reusable functions, query optimisation, regular expressions, time-series analysis, enterprise hunting queries and complete hunting workbooks.
Lessons 121–130 Advanced KQL Enterprise threat hunting
Lesson 121 — Advanced KQL: Mastering Join Operations Learn how security analysts use advanced KQL join techniques to correlate Microsoft Defender XDR telemetry across multiple tables, build richer investigations, improve hunting accuracy and create efficient enterprise-scale queries.
Lesson 122 — Advanced KQL: Working with Dynamic Data Learn how security analysts work with dynamic data in KQL by exploring JSON objects, arrays and nested Microsoft Defender XDR telemetry using functions such as parse_json(), mv-expand, bag_unpack() and property accessors to extract valuable investigation evidence.
Lesson 123 — Advanced KQL: Mastering mv-expand Learn how security analysts use mv-expand to expand arrays and multi-value fields within Microsoft Defender XDR telemetry, making it easier to analyse authentication details, alert evidence, entities and other complex datasets stored as dynamic objects.
Lesson 124 — Advanced KQL: Optimising Query Performance Learn how to write faster, more scalable KQL by reducing unnecessary data processing, optimising joins, filtering early, minimising expensive operations and improving query efficiency across large Microsoft Defender XDR environments.
Lesson 125 — Advanced KQL: Building Reusable KQL Functions Learn how security analysts create reusable KQL functions to standardise threat hunting, simplify complex queries, reduce duplicated logic and build scalable investigation workflows across Microsoft Defender XDR and Microsoft Sentinel.
Lesson 126 — Advanced KQL: Advanced parse_json() Learn how security analysts use parse_json() to extract, navigate and analyse nested JSON objects within Microsoft Defender XDR telemetry, transforming complex dynamic data into meaningful investigation evidence.
Lesson 127 — Advanced KQL: Advanced Regular Expressions Learn how security analysts use advanced regular expressions to identify complex patterns, extract hidden indicators, detect suspicious activity and perform precision threat hunting across Microsoft Defender XDR telemetry.
Lesson 128 — Advanced KQL: Advanced Time Series Analysis Learn how security analysts use advanced time series analysis in KQL to identify trends, detect anomalies, baseline normal behaviour and uncover suspicious activity across Microsoft Defender XDR telemetry using powerful time-based analytics.
Lesson 129 — Advanced KQL: Building Enterprise Hunting Queries Learn how security analysts build enterprise-scale KQL hunting queries by correlating identity, endpoint, email and cloud telemetry, combining multiple Microsoft Defender XDR tables into powerful, scalable threat hunting investigations.
Lesson 130 — Advanced KQL: Building a Complete Hunting Workbook Learn how security analysts combine advanced KQL techniques to build a complete Microsoft Defender XDR hunting workbook, correlating identity, endpoint, email and cloud telemetry into a structured investigation framework for enterprise-scale threat hunting.
Learning Path 12 — Module 11: Identity Threat Hunting Move beyond isolated sign-in events and investigate identity behaviour as evidence. Follow authentication, MFA, Conditional Access, privilege, source infrastructure, sessions and cloud activity through complete Microsoft identity investigations.
Lessons 131–140 Module 11 complete Microsoft Entra Defender XDR Identity threat hunting
Lesson 131 — The Successful Sign-In That Wasn't Normal Use KQL to investigate a successful Microsoft Entra sign-in that looks legitimate at first glance, then test location, source, authentication and surrounding activity to determine whether it really fits the user.
Lesson 132 — Hunting MFA Fatigue and Repeated Authentication Attempts Use KQL to identify repeated authentication attempts, investigate MFA fatigue patterns and determine whether a burst of prompts represents user error, automation or an active identity attack.
Lesson 133 — Detecting Newly Registered MFA Methods Use KQL to investigate newly registered authentication methods, correlate registration activity with sign-ins and determine whether the change belongs to the legitimate user.
Lesson 134 — The Conditional Access Result Didn't Tell the Whole Story Use KQL to investigate Conditional Access outcomes in context and determine what the result does — and does not — prove about a suspicious sign-in.
Lesson 135 — The Privileged Role Became Active at 2:07 AM Use KQL to investigate privileged role activation, correlate the event with surrounding sign-in activity and determine whether the elevation fits legitimate administrative behaviour.
Lesson 136 — The Same IP Address Touched Five Accounts Use KQL to pivot from a single source IP across multiple identities and determine whether the pattern points to password spraying, credential testing or another shared source.
Lesson 137 — The Sign-In Was Successful but the Session Wasn't Normal Use KQL to investigate what happened after successful authentication and determine whether the session behaviour, applications, resources and surrounding identity activity still fit the legitimate user.
Lesson 138 — Following an Identity Across Multiple Tables Use KQL to follow one identity across multiple Microsoft security data sources, correlate related events and build a single investigation story from sign-in, cloud, endpoint and identity telemetry.
Lesson 139 — Building an Identity Compromise Timeline Use KQL to reconstruct an identity compromise chronologically, correlate authentication and post-authentication evidence, and turn separate security events into a defensible investigation timeline.
Lesson 140 — The Identity Threat Hunting Investigation Complete an end-to-end identity threat hunting investigation with KQL, following evidence from suspicious authentication through source-IP pivots, privilege, persistence and post-authentication cloud activity to a defensible conclusion.
Continue Your KQL Training You've reached the end of the KQL lessons listed on the main Agent Foskett Academy page — but the investigation continues.

Continue into the dedicated Agent Foskett KQL Academy for the latest lessons, including Module 14: Advanced Detection Engineering & Proactive Threat Hunting.

Your first KQL idea

A KQL query usually starts with a table, then narrows the result set using filters. This simple example starts with EmailEvents and asks: show me recent email activity from the last 24 hours.
first-email-events-query.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
EmailEvents
| where Timestamp > ago(24h)
| project Timestamp,
                            SenderFromAddress,
                            RecipientEmailAddress,
                            Subject,
                            DeliveryAction
| order by Timestamp desc
Start with a table EmailEvents tells Defender XDR which email telemetry source you want to investigate.
Filter the time window The where line narrows the query to recent data so you are not searching everything at once.
Project useful columns Project helps you choose only the fields that matter for the investigation.

How to think in KQL

A good KQL query starts with a good investigation question. Before writing anything, ask what you are trying to prove, disprove or understand.
What happened? Start with the event. Was it an email, sign-in, process, URL click, alert or configuration change?
Who or what was involved? Pivot on the user, device, sender, IP address, URL, process name or message ID.
Does the behaviour make sense? The most important question is often not whether something happened, but whether it fits the environment.

Learn through real Agent Foskett investigations

Every Academy lesson should connect back to practical investigations. That is what makes the learning useful: syntax connected to real security outcomes.
Email investigations Use KQL to investigate spoofed senders, DMARC failures, delivery actions, suspicious subjects and URL clicks.
Identity investigations Use KQL to review sign-ins, MFA behaviour, session reuse, risky locations and authentication patterns.
Endpoint investigations Use KQL to hunt process execution, suspicious command lines, LOLBins, network connections and device timelines.
The logs already know the story.
Agent Foskett Academy helps investigators learn how to ask the right questions inside Microsoft telemetry.
Continue the investigation

Final thought

KQL becomes powerful when it stops being a language you memorise and becomes a way of thinking.

Start with one question. Choose the right table. Filter the noise. Project the useful fields. Follow the evidence.

That is how investigations begin.

Agent Foskett Academy exists to help defenders learn KQL through real Microsoft security stories.
At GEMXIT We help organisations investigate Microsoft Defender XDR, Microsoft Sentinel, Entra ID, endpoint activity, email threats, KQL hunting and practical security operations workflows.
Agent Foskett mindset The question is not only: “Can I write the query?”

It is: “What question am I asking the data?”

Continue learning with Microsoft Defender KQL Threat Hunting Guide, KQL Threat Hunting in Defender and Sentinel, EmailEvents KQL Guide, KQL Email Spoofing, Microsoft Security, Security Operations and the GEMXIT Security Review.

Develop IT. Protect IT. GEMXIT PTY LTD | GEMXIT UK LTD
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

Agent Foskett Academy Microsoft security learning paths

Agent Foskett Academy includes over 300 published practical lessons plus the new 100-lesson SOC Analyst Academy roadmap across KQL, Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Defender for Endpoint and Microsoft Defender for Cloud.

Learn KQL and Microsoft security investigations

Follow structured lessons covering EmailEvents, UrlClickEvents, DeviceProcessEvents, DeviceNetworkEvents, identity telemetry, alerts, incidents, cloud security posture and investigation workflows, including complete Identity Threat Hunting, Advanced Endpoint Investigation and Advanced Cloud & SaaS Investigation modules, with Advanced Detection Engineering & Proactive Threat Hunting now underway.

Dedicated Microsoft security academies

Choose the KQL Academy, SOC Analyst Academy, Microsoft Sentinel Academy, Microsoft Entra Security Academy, Defender for Endpoint Academy, Defender for Cloud Academy or Microsoft Security Copilot Academy.

Practical threat hunting and incident response

Build skills through practical KQL examples, Defender XDR advanced hunting, Sentinel SOC operations, identity protection, endpoint investigations, cloud security scenarios, proactive threat hunting and detection engineering.

↑