kql

Email hunting in Defender XDR means juggling four tables. UnifiedEmailData is a parameterized KQL function that returns one row per email with all attachments, URLs and post-delivery actions nested, including built-in filters that keep the query cheap.

A guide on critical SharePoint vulnerability CVE-2025-53770/CVE-2025-53771 and how to hunt for it using Advanced Hunting and Live Response to identify exploitation attempts via IIS logs.