Sessions

Workshop & sessions

Friday 30 October 2026 · all times CET. The morning workshop is In-person only; afternoon sessions are In-person and Online.

Morning

In-person only · CET

  1. 08:1509:00
    Registration
  2. 09:0012:00
    Workshop: Dissect the Case
    Gianni Castaldi & Diego Caminada
  3. 12:0013:00
    Lunch

Afternoon

In-person & Online · CET

  1. 13:0013:10
    Opening
    Gianni Castaldi & Alex Verboon
  2. 13:1013:50
    KQL$ a Defender Boys production
    Mattias Borg & Stefan Schörling
  3. 14:0014:50
    AI-Assisted Detection Engineering
    Fabian Bader
  4. 15:0015:50
    Create your own TI feed + MISP population via KQL
    Sergio Albea
  5. 16:0016:30
    Break
  6. 16:3017:20
    Less-Known Identity Threat Hunting Tricks
    Pawel Partyka
  7. 17:3018:20
    Kusto KITT: Knowledge, Inspection, Tuning, and Tooling for KQL
    Olaf Hartong
  8. 18:3019:20
    You’ve Got Malicious Mail: Hunting Email & Teams with KQL
    Daniel Mozes
  9. 19:2019:25
    Wrap-up

FAQ

Your questions answered

Can I watch the sessions later?

The live event comes first. Whether a session is recorded is up to each speaker and depends on the recording quality.

What time zone are the times in?

All times are Zürich time (CET).

Do I need ID to get in?

Yes. Bring a government-issued photo ID and show it to building security.