Viewed
A skill, in practice
KQL
Explore how I used KQL through 2 case stories.
Experience at UK Water Utility
All cards in this section are viewed.
UK Water Utility
From business risk to detection
Detection Engineering / Detection as CodeBuilt a governed Sentinel detection workflow, supported versioned KQL, and co-developed a model linking business threats to telemetry and validation.
Read the storyUK Water Utility
Automate endpoint investigation and response
Response Automation / Incident Response EngineeringBuilt PowerShell and KQL investigation tools around Defender for Endpoint, and enabled Microsoft Defender’s native automated account containment.
Read the storyRelated skills
Detection lifecycle designDetection as code designAzure DevOpsGitMicrosoft SentinelTelemetry requirementsThreat modellingTechnical governancePowerShellDefender Live ResponseDefender Attack DisruptionPersistence analysisEndpoint configurationRunbook developmentMicrosoft Defender for EndpointMicrosoft Entra ID