Cybersecurity investigation quick reference

Start with the evidence or behavior already in front of you. Use search for a specific event ID, table, command, protocol, service, or technique.

Hunting Workflows
Ready-to-run Microsoft Sentinel and AWS behavioral hunts with investigation pivots.

Event and Activity Reference
Provider-aware lookup for curated Windows, Sysmon, Defender, PowerShell, and service events.

Endpoint and Host
Windows, Linux, macOS, Sysmon, processes, memory, PowerShell, and persistence.

Identity and Access
Authentication, Active Directory, privileges, and identity attack paths.

Network
Packets, flows, DNS, HTTP, TLS, destination history, and correlation.

Cloud and SaaS
AWS, Azure, Microsoft Entra, Microsoft 365, and Google Cloud references.

Detection Engineering
Collection gaps, behavioral baselines, anomaly features, and endpoint visibility.

Query Languages
Splunk SPL and Microsoft KQL syntax cross-reference.

Start with what you have

Starting evidence	Go first
Sentinel, Defender XDR, or AWS telemetry requiring a runnable hunt	Hunting Workflows
Event ID, provider, channel, audit activity, or operation name	Event and Activity Reference
Device, process, hash, file, service, or command line	Endpoint and Host
Account, sign-in, MFA event, token, or privilege change	Identity and Access
IP address, domain, URL, packet, session, or flow	Network
Azure resource, AWS event, storage object, or SaaS activity	Cloud and SaaS
Collection blind spot, baseline, or new analytic	Detection Engineering
SPL or KQL syntax question	Query Languages