ATTRIBUTION
Sources & credits
Thanks to the people, projects, and organizations whose documentation and research inform this reference. Names link to their websites; numbered links point to the sources used.
Community
Cloudbrothers
Research and KQL examples for Graph activity and sign-in correlation. [1] [2] [3] [4]
Thomas / Cloud-Architekt
Hunting examples for token correlation, XDR behaviors, and exposure graphs. [5] [6] [7] [8] [9]
Companies & organizations
CrowdStrike
Host and vulnerability documentation used for enrichment mappings. [10]
Cloud and Workspace log documentation used in table descriptions. [11] [12] [13] [14] [15] [16] [17] [18] [19] [20]
Invictus IR
Research on AAD Graph activity logs and sign-in identifiers. [21]
Microsoft
Hunting schema, table and field documentation, and identifier guidance. [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50]
OASIS
STIX specifications used for threat intelligence fields and relationships. [51]