Malicious Event Pivot and Investigative Timeline Reconstruction
This rule is designed to reconstruct an investigative timeline around a specific device and timestamp identified by an initial network event. It aggregates process execution, file activity, network connections, and alert evidence from the affected device within a specified time window before and after the triggered pivot event, facilitating incident investigation and root cause analysis.
Microsoft Sentinel (KQL)
