Dissect the Case

You get the case.
You get the telemetry.
You do not get the answer.

Together we work through a realistic security investigation and use KQL to uncover what happened, one clue at a time.

Expect pivots, dead ends, unexpected findings and plenty of discussion about what is signal, what is noise and what is actually worth detecting.

This isn’t a workshop where we show you a finished attack timeline and explain the queries afterwards. You investigate first. Then we compare notes. Then the case moves on.

Bring your laptop. Trust the telemetry.

€85 + PayPal fee · Friday 30 October 2026 · CET

Led by

Your investigators