About
the handle, the scope, the boundaries
The handle
A leftanti join returns the rows on the left that have no match on the right — what is there when you subtract everything accounted for. That is most of detection work: not finding the thing that matches, but noticing what is left once everything explainable has been removed.
The site mark draws it literally. Two overlapping circles, the left one filled with the intersection cut away, the right one outlined and empty.
The scope
Notes on detection engineering, KQL, and threat hunting, mostly against Microsoft Sentinel and Defender. Queries are written to be copied, adapted, and tuned against your own data — not deployed as-is. Every threshold here is a starting point, and every one of them is wrong for somebody's tenant.
There is no comments section, no newsletter, and no tracking. The site makes no requests to anything other than its own origin: no fonts from a CDN, no analytics, no embeds.
The boundaries
All content is my own, published in a personal capacity. Everything here is built from scratch on my own time and infrastructure — nothing derives from any employer's or client's environment.
Table names, techniques, and thresholds in examples are generic or invented. Where a query references a watchlist or a lookup, that is an illustration of a pattern rather than a description of a real one.
Contact
Corrections are welcome, particularly on the tuning notes — those are the parts most likely to be wrong outside the environment they were written against.