Free: the KQL Detection Tuning Checklist

Most detections don’t fail because the logic is wrong. They fail because the threshold was a guess, the exclusions quietly grew until nothing could fire, or nobody checked the query would catch the thing it was written for.

This five-page checklist walks one hunting query through the fixes, in order:

• Look before you set a threshold: measure normal with percentiles over 30 days, and set the number just above it.
• Keep exclusions narrow: combinations rather than whole accounts, in a watchlist, each with an owner and a review date.
• Catch the quiet mistakes: the ones that return zero rows instead of an error.
• Turn a hunt into an alert: lookback, frequency, suppression, entities, severity and the three response steps every rule needs.
• Review it once it’s live: a query that shows how each rule’s incidents were closed, so you know what to tune.

It works with the free KQL hunting queries, or any Sentinel or Defender hunting query of your own. If you’re just starting out, the KQL hunting guide covers what to hunt first.

Subscribe below and the download link is on the page you land on after confirming. You’ll also get each new post by email, every other Tuesday. No spam, and every email has an unsubscribe link.