HuntriageBetaFrom one clue to a defensible hunt.

Local processing · No query data sent to IMPLEMONIMPLEMON

What do you want to know?

Paste a clue to see what you can investigate.

Investigation

Paste a clue on the left and choose a question. The investigation path, the query, and what it can and cannot tell you appear here.

Investigation provenance

    Evidence returned

      Sources and verification

        Why this works

          What this proves

            What this does not prove

              Assumptions this rests on

                Test it another way

                  Query validation

                  Loading the Kusto checker

                  Checks that the KQL is well formed and that every table and column exists in the documented schema. It does not check whether the investigation logic is right. That is what Investigation checks are for.

                  Investigation checks

                    This line

                    Click any line in the query to see what it does.

                    How the query fits together

                      Microsoft Defender is a trademark of Microsoft Corporation. Huntriage is an independent IMPLEMON product and is not affiliated with or endorsed by Microsoft.