When you group your logs by timestamp(binning) to detect threats, you probably cause false negatives. Solve it using sliding window counts! academy.bluraven.io/blog/advance... #KQL #ThreatHunting #DetectionEngineering - ThreadSky | a Reddit-style client for Bluesky

cyb3rmonk.bsky.social • 2 days ago

When you group your logs by timestamp(binning) to detect threats, you probably cause false negatives. Solve it using sliding window counts!

https://academy.bluraven.io/blog/advanced-kql-for-threat-hunting-window-functions-part-2

#KQL #ThreatHunting #DetectionEngineering

Comments