Pierre Thoor

You ran a query in #kusto and forgot to do a project, reorder or filter and you don't want to have to re-run the query to update the output. Use the {result} object

#Kusto can be used for many things. This picture is from our demo earlier today at @ExpertsLiveDK - A potential idea is to do something similar combined with #Azure OpenAI Service - For people working with data science I encourage you to look into Kusto if you haven't already - Learn Kusto today learn.microsoft.com/en-us/training… #Defender #DataScience #AI #ADX #Sentinel #MicrosoftFabric #Community

Had a delivery thanks to @PierreThoor waiting for me on my return to Australia, I was fortunate enough to write the foreword for him for his Microsoft Defender for Identity book, which I highly recommend! Congratulations once more on the achievement Pierre.

@reprise_99 You’re the best!

@reprise_99 Had issue with the base64_decode_to string() for some months ago, need to see if I can reproduce it

People often share full Kusto queries, which is awesome, but what about those handy one liners and tips you have picked up along the way? Here are some of my favourites, share yours below! Extend an additional column for your local time, example +5 UTC: | extend LocalTime = TimeGenerated +5h Find events only on weekends, cast a variable to make it easy to read: let Saturday = time(6.00:00:00); let Sunday = time(0.00:00:00); AuditLogs | where dayofweek(TimeGenerated) in (Saturday, Sunday) Find events during certain hours of the day: | where hourofday(TimeGenerated) !between (4 .. 23) Calculate the minutes (or hours or days etc) between two events: | extend ['Minutes Between Events']=datetime_diff("minute",Timestamp1,Timestamp2) Parse the details, including browser family and version etc of a user agent: | extend UserAgentDetail = todynamic(parse_user_agent(UserAgent, "browser")) Decode base64 encoded strings, useful for PowerShell: | extend DecodedCommand = base64_decode_tostring(EncodedCommand) Rename columns while using project: | project LogTime=TimeGenerated, SigninLocation=Location, IP=IPAddress, Agent=UserAgent

✨ Track Speakers: Security ✨ 🚀 Ready to dive deep into the world of Microsoft Security? 🔐✨ 🌟 Meet some of the industry’s brightest minds at Experts Live Denmark 2025 on March 5th and soak up all the knowledge. 💡🔥 🔗 Check it out now: conference.expertslive.dk Meet the rockstars: @paulacqure | @BertJanCyber | @cbrhh | @mattiasborg82 | @rodtrent | @PierreThoor | @fabian_bader | @koosgoossens | @knudsenmortendk | @henrikwojcik #ELDK2025 #ExpertsLiveDK #Microsoft #Community #Security #Azure #AI #ModernWorkplace #Intune #DevOps #Automation #M365 #PowerPlatform #Data #Purview #Development #OpenAI #Copilot #AVD #W365 #Identity #Entra ELDK2025 Organizers: Morten Knudsen (@knudsenmortendk) Thomas Poppelgaard (@_POPPELGAARD) Martin Byskov (@ByzzByskov) Henrik Wojcik (@henrikwojcik) Heine Madsen (@HeineKoldbro) Kent Agerlund (@agerlund)

@reprise_99 @NathanMcNulty Amen! 😂

@NathanMcNulty Every day is kql day!

If you made a drinking game where you took a shot every time you hear the word 'project' on an election day you would probably die in roughly 90 seconds

@PierreThoor I wanna see it!

Let’s not leave our Windows friends alone :(

Here’s the thing folks. I’ve been coding 32 years. When something like this happens it’s an organizational failure. Yes, some human wrote a bad line. Someone can “git blame” and point to a human and it’s awful. But it’s the testing, the Cl/CD, the A/B testing, the metered rollouts, an oh shit button to roll it back, the code coverage, the static analysis tools, the code reviews, the organizational health, and on and on. It’s always one line of code but it’s NEVER one person. Implying inclusion policies caused a bug is simplistic, reductive, and racist. Engineering is a team sport. Inclusion makes for good teams. Good engineering practices makes for good software. Engineering practices failed to find a bug multiple times, regardless of the seniority of the human who checked that code in. Solving the larger system thinking SDLC matters more than the null pointer check. This isn’t a “git gud C++ is hard” issue and it damn well isn’t an DEI one.

@0xTib3rius “1, 2, 3, 4 - wait, how many reboots have I done on this machine…?”

Lol, Microsoft are suggesting rebooting machines 15 times can solve the problem. This. Is. Chaos. #CrowdStrike #CrowdStroke #CrowdStruck

Just wanted to tweet with the #mvpbuzz hashtag again because I know y'all are refreshing it

@reprise_99 @MicrosoftPress ❤️🙏🌟

My friends at @MicrosoftPress have given me a couple of copies of the eBook for The Definitive Guide to KQL to give away. Retweet or comment below and I will put you in the draw. To give everyone a chance, I will give it 48 hours and then draw two winners. aka.ms/KQLMSPress/Sto…

@reprise_99 @markmorow @rodtrent I will definitely order it!! Well done!

All the writing and review work for The Definitive Guide to KQL is now complete and the book is now heading into production! @markmorow, @rodtrent and I can't wait for you to have a read. You can pre-order it here aka.ms/kqLMSPress/

@MicrosoftHelps please fix Teams from crashing!! So close to uninstall the client... #MVPBuzz #MicrosoftTeams #TeamsCrashes

@kettukari @amandassterner No CfP this year to the event?

Are you attending Stockholm TechShow in May? Me and @amandassterner share our experiences and best practices of Modern Work with AI ✨ #AI #Copilot #TechShow stockholmtechshow.se

@virtualmanc Don’t forget that we have our own Azure Region 🇸🇪😜 #swedencentral #Azure

I am creating all our resources for Tuesday's Nerdio Customer Innovation Day in Sweden. My first visit to Stockholm, and I see it will be a lovely -14 degrees! #AVD #Nerdio

@code My favorite!!

Gone are the days of trying to come up with descriptive commit messages... Let Copilot generate them for you ✨

🤖 GitHub Copilot just keeps getting smarter and smarter! In case you missed them, here are 4 of the newest features that you're going to love 🧵

@AzureSupport Thanks for the transparency and quick response! 10 points! 👍

@PierreThoor We have confirmed the issue impacting Azure Traffic Manager has been mitigated. A detailed resolution statement can be found in the Azure portal at aka.ms/AzureServiceHe…. ^AS

@AzureSupport the Azure Portal are acting weird, any ongoing issues?