41554 blogs · 4,417,066 posts Claim your blog

Record · corpus.blog/posts/01a08796-e978-7186-aa65-26e9ad69f882

Defender for Endpoint Timeline Internals

kqlquery.com · published 25 January 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at kqlquery.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 16
Words captured: 5,913

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/matthieugras/timeline-downloader

github.com

https://www.binaryanalys.is/posts/defender_timeline

binaryanalys.is

https://kqlquery.com/images/Defender-Timeline-Internals/Execution.png

kqlquery.com

https://kqlquery.com/posts/kql-incident-response-everything-else/

kqlquery.com

https://learn.microsoft.com/en-us/azure/data-explorer/start-for-free-web-ui

learn.microsoft.com

https://kqlquery.com/images/Defender-Timeline-Internals/IsCyberData.png

kqlquery.com

https://kqlquery.com/images/Defender-Timeline-Internals/ActionType.png

kqlquery.com

https://kqlquery.com/images/Defender-Timeline-Internals/SourceProvider.png

kqlquery.com

https://kqlquery.com/images/Defender-Timeline-Internals/MitreInfo.png

kqlquery.com

https://github.com/Bert-JanP/SecScripts/blob/main/MITRE%20Layers/mitre-coverage-layer_Version2.json

github.com

https://kqlquery.com/images/Defender-Timeline-Internals/CyberActionType.png

kqlquery.com

https://falconforce.nl/microsoft-defender-for-endpoint-internals-0x04-timeline-telemetry/

falconforce.nl

https://github.com/Bert-JanP/SecScripts/blob/main/Other/OneCyberEvents.csv

github.com

https://kqlquery.com/images/Defender-Timeline-Internals/Translation.png

kqlquery.com

https://learn.microsoft.com/en-us/defender-endpoint/custom-data-collection

learn.microsoft.com

https://kqlquery.com/images/Defender-Timeline-Internals/DelayedDropAndLoading.png

kqlquery.com