Threat Hunting & SecOps Lab

Sentinel & KQL Query Console

A browser-native Kusto Query Language execution engine running on realistic enterprise telemetry—including Defender for Endpoint process creations, Entra ID authentication & PIM audit streams, and live honeypot intercepts. Zero server roundtrips.

Terminal Windows PowerShell: Run curl.exe sumitatre.com/resume or irm sumitatre.com/resume to view the plain text resume directly without object wrappers.

Preset Threat Hunts (Click to Run) Shift + Enter to run custom query

Ready | Press Shift + Enter to run

0 records

Query Results

0 records

Select a preset threat hunt above or click "Run Query" to evaluate telemetry.

Telemetry Datasets & Schema + Expand

KQL Syntax Quick Reference (Click to Insert) + Expand

| where Col in~ ("a", "b")

Case-insensitive set filtering

| where Col has_any ("x", "y")

Match any substring term

| where Col == "val"

Exact field equality

| summarize count() by Col

Group aggregation & count

| project Col1, Col2

Select output columns

| order by Col desc

Sort output records

| take 10

Limit record volume

Open Full Sentinel KQL Field Guide →