Query Details

Options: Draft | InProgress | Stable | Deprecated

Templatev2

Query

let lookback = 7d;
YourTableName
| where TimeGenerated >= ago(lookback)
// Add filters for the behavior you want to find.
| project *
| sort by TimeGenerated desc

About this query

Explanation

This KQL query template is designed for threat hunting purposes. It examines data from a specified table over the past seven days to identify potentially suspicious or noteworthy activities. The query filters the data based on the time it was generated and sorts the results in descending order, making it easier to review the most recent events first. Analysts can customize the query by adding specific filters to target particular behaviors or activities of interest. This approach helps in proactively identifying threats or anomalies in the data, allowing for timely investigation and response.