KUSTOHAWK

Summary from the TLDR InfoSec newsletter

KustoHawk is an incident triage and response tool for Microsoft Defender XDR and Sentinel. It collects indicators of compromise and shows device or account activities. Using Graph API, it runs hunting queries in the Resources folder.