Hunting Impossible Travel in Sentinel with KQL
Two sign-ins too far apart in time and distance to be one person. In Sentinel, KQL's prev() and a distance function are all it takes.
Most security problems aren't exotic
They're the seams nobody owns, the permissions nobody removed, the detections nobody can read, and the reports nobody noticed were wrong. I write about fixing them, practically and plainly, from over a decade in security engineering, hybrid cloud and large-scale infrastructure.
New to threat hunting in Sentinel? Start with the KQL hunting guide: what to hunt first, and in what order.
Latest posts
Starting a Site with Hugo: Own the Place You Write
Part one of building a site you actually own. Why static, why this stack, and getting Hugo running on your machine in ten minutes.
Break-Glass Accounts: The Ones You Hope You Never Use, Done Properly
Entra break-glass (emergency access) accounts: cloud-only, excluded from every policy, watched closely, and tested before you need them.
Hunting Password Spray in Sentinel: One Password Against a Thousand Doors
Brute force tries many passwords on one account. Spray tries one password on many accounts, and hides under your lockout threshold. Here's the shape it leaves.
5 DAX Mistakes That Quietly Break Your Power BI Reports
Five silent DAX failures that can make Power BI measures and visuals disagree, and the defensive habits that stop them.