Analytic rule querying

FeintBE Are you familiar with our Livestream component in the Hunting blade. When you right-click on a query here, you can add it to the Livestream tab where you can start and stop the stream. What this does is set the query to run every 1 minute and you'll be alerted through Azure notifications as long as the livestream is active. The display for the active Livestream will also increment whenever the result is reached. This is a great way to monitor a potentially active threat.