Search for Microsoft security blog posts written and shared by the community. Discover insights on Azure, Defender, Entra, Intune, Sentinel, and more.

Defender for Endpoint Timeline Internals

January 25, 2026 by Bert-Jan Pals

defender

Explore Microsoft Defender for Endpoint timeline internals, OneCyber telemetry, MITRE mapping, and DFIR workflows using exported timeline data, jq and KQL.

Read full article →