/ series · 01 post

Attack Walkthroughs.

← All writing

Step-by-step technique breakdowns: how a TTP works, what telemetry catches it, and where detections fail.

Part 01

Noisy sign-in triage: the small joins that matter

A KQL pattern that cuts false-positive volume on sign-in alerts by joining SigninLogs with identity context — and why the naive filter falls short.

Mar 08, 2026