Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example:

IdentityLogonEvents

| where TimeGenerated >= ago (7d)

| where UserPrincipalName == "user name@domain"

Bold: Indicates a new term, an important word, or words that you see on screen. For instance, words in menus or dialog boxes appear in bold. Here is an example: “In the Microsoft 365 Defender portal, select Permissions, then Settings, followed by Microsoft 365 Defender. Select Permissions and roles to view the available options.”

Tips or important notes

Appear like this.