dstreefkerk

KQL Best Practices for LLM Query Development

Core Performance Principle

"Query performance depends directly on the amount of data processed" - Always minimize data processing through strategic filtering and early reduction.

1. Data Reduction First

Time Filtering (Critical)

// ✅ GOOD: Time filter first (leverages indexing)

dstreefkerk

#####################################################################
# FortiAnalyzer CEF Integration - Syslog-ng Configuration
#####################################################################
# Equivalent to the rsyslog configuration for FortiAnalyzer CEF forwarding
# to Microsoft Sentinel via Azure Monitor Agent
#
# PROBLEM:
# --------
# FortiAnalyzer sends CEF messages in partial syslog format:
#   SENDS:     "MMM dd HH:mm:ss hostname CEF:0|..."

dstreefkerk

#####################################################################
# FortiAnalyzer CEF Integration - Production Configuration
#####################################################################
#
# PURPOSE:
# --------
# This configuration solves the critical protocol compliance issue with 
# FortiAnalyzer CEF log forwarding to Microsoft Sentinel via Azure Monitor Agent.
#
# PROBLEM:

dstreefkerk

#!/usr/bin/env python3
"""
WordPress to Jekyll Migration Script using Claude Code CLI

This script:
1. Takes a WordPress export XML file path as input
2. Lists all matching posts based on runtime parameters
3. Allows the user to select which posts to migrate
4. Extracts posts from the WordPress export
5. Uses Claude CLI to convert each post to Jekyll format (or simulates conversion with --dry-run)

dstreefkerk

Task

Based on this conversation, infer and summarise the user's apparent expertise, professional background, and relevant technical knowledge.

Support your inferences by citing specific examples from the conversation, such as:

• technical terminology used accurately,
• problem-solving approaches demonstrated, or
• domain-specific insights provided.

Ensure your summary is objective, evidence-based, and concise.

dstreefkerk

"""
Sigma to Microsoft Sentinel KQL Converter
-----------------------------------------

This script converts Sigma detection rules to Microsoft Sentinel KQL (Kusto Query Language) format
using the SOC Prime translation service.

SOC Prime, Inc (https://socprime.com) provides the translation API (uncoder.io) that powers this converter.
This script is a client for that service and is not affiliated with or endorsed by SOC Prime, Inc.

dstreefkerk

Azure Management SecurityInsight SDK for Python

Table of Contents

• Overview
• Installation
• Authentication
• Client Class
• Operation Groups
• Alert Rules Management

dstreefkerk

MCP Safety Audit: Gas Stoves with Manual Cooking Protocol Allow Major Burn Vulnerabilities

Executive Summary
Gas stoves, which operate under the legacy Manual Cooking Protocol (MCP), have been found to allow users to willingly place their hands on active burners, resulting in severe thermal compromise. Despite long-standing warnings, manufacturers continue to ship these devices with unrestricted flame access and no built-in user safety interlocks.

Key Findings

• No Authentication for Ignition: Any user, regardless of clearance or training, can initiate flame generation with a simple knob twist.
• Direct Contact Vulnerability: Users can directly touch the burner while it's active. No safeguards prevent this. Zero.
• Lack of User Behaviour Sandboxing: The system permits reckless multi-tasking, such as reaching over multiple lit burners to grab a spice jar.
• No Real-Time Alerting: Burn events are not logged, monitored, or alerted. Incident response relies on screaming.

dstreefkerk

// This query retrieves all Microsoft Sentinel-enabled Log Analytics workspaces the user has access to.
// It checks for Sentinel by looking for the 'SecurityInsights' solution in 'Microsoft.OperationsManagement/solutions'.
// The join is done using the full resource ID of the workspace.

resources
| where type == "microsoft.operationalinsights/workspaces"
| extend workspaceId = tostring(properties.customerId), workspaceName = name, workspaceResourceId = tolower(id)
| join kind=leftouter (
    resources
    | where type == "microsoft.operationsmanagement/solutions"

dstreefkerk

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "NamePrefix": {
            "defaultValue": "",
            "type": "String",
            "metadata": {
                "description": "Optional prefix to prepend to all resource names for easy identification."
            }