Summary
In this chapter, we covered a lot but also seemingly didn't even touch the surface. There is so much more to each of these categories that I feel each could be a chapter on its own. We covered what Kusto queries are and some best practices to help optimize them. Then, we looked at hunting in the M365 Defender portal and working with the results that have been obtained from queries. From there, we looked at shared queries, as well as the community-provided ones. Don't forget about custom detections, as we spent some time working without ASR rule examples.
Finally, we went through some of the hunting capabilities of Microsoft Sentinel by touching on custom hunting queries, livestream, bookmarks, and hunting with notebooks.
As I said earlier, we hardly touched the services in some of these areas. The goal was to get you more familiar with what they are and how they work so that you're prepared to digest exam questions regarding what they can do and if they...
