plan-sentinel-hunt
Plan an authorized Microsoft Sentinel threat hunt as an observable, falsifiable, surface-specific investigation before writing KQL.
Pinned to revision d090c6ad51e6, so it is the text this page describes rather than whatever the author pushed since.
Files
Every link opens the file at its source, pinned to the revision this page describes.