KQL Kata on Matt Swann — Detection Engineering & Threat Intel

KQL Kata on Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/series/kql-kata/Recent content in KQL Kata on Matt Swann — Detection Engineering & Threat IntelMatt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/og-image.pnghttp://mattswann.dev/og-image.pngHugoen-usMon, 05 Jan 2026 09:18:38 -07005 KQL Queries to Slash Your Containment Time in Microsoft Sentinelhttp://mattswann.dev/posts/5-kql-queries-containment/Mon, 05 Jan 2026 09:18:38 -0700http://mattswann.dev/posts/5-kql-queries-containment/In an active breach, speed is everything. These five KQL queries — covering file drops, identity compromise, lateral movement, C2 beaconing, and persistence — are designed for the first hour of incident response.