Endace

The Endace (https://www.endace.com) solution for Microsoft Sentinel enables you to create Pivot-to-Vision URL links from alerts in your CEF logs. Pivot-to-Vision links take you directly from an alert to viewing the related packets of interest in EndaceVision, Endace's traffic analysis application. In EndaceVision, you can further analyze the incident and zoom in to inspect decoded, full packet data. The KQL in this example can be easily adapted to be used for other advanced features associated with threat hunting, such as in tickets, workbooks, and wherever KQL can be leveraged.