KQL Hunting Lab: Find the Intrusion (opens in a new tab)
Six hands-on modules, with a free lab environment included: a week of sign-in logs, one attacker hidden inside, and everything you need to find them. Start here if you're new to KQL.
Products
I build these from the same work the posts come from. Each one solves one problem properly, and the posts will always show you the technique for free. These just save you the typing.
KQL Hunting Pack (opens in a new tab)
Twelve ready-to-run detection queries for Microsoft Sentinel, each commented and built with placeholders for your own environment. The next step after the Lab.
Hugo + Cloudflare Starter Kit (opens in a new tab)
The setup behind this site: Hugo, GitHub and Cloudflare Pages, pre-wired with security headers, fingerprinted CSS and scheduled publishing. Unzip it and run.
KQL Hunting Bundle: Lab + Hunting Pack (opens in a new tab)
The KQL Hunting Lab and the KQL Hunting Pack together: learn to hunt on a week of realistic logs, then put twelve ready-to-run detections into Sentinel. €4 less than buying both.
KQL Detection Tuning Checklist (opens in a new tab)
Five pages on turning a hunting query into an alert your team still trusts: thresholds from real data, narrow exclusions, the mistakes that return zero rows, and the monthly review. Free.
Prices are before VAT, which Gumroad adds at checkout where it applies.