Make recurring investigation questions reusable

My KQL functions cover Entra sign-in context, VPN address attribution and Defender account actions. The accompanying runbooks explain investigation of NTLM/Kerberos brute force, Pass-the-Ticket, unwanted software, reconnaissance and Sysmon health. I also contributed investigation standards covering evidence, root cause, impact and response.