A Free KQL Lab: Real Defender Data in a Free ADX Cluster

Your best KQL practice data disappears after 30 days. Advanced Hunting keeps a month. The slow intrusion you wanted to study ages out with it, and production was never a safe place to practise anyway:

Your best KQL practice data disappears after 30 days. Advanced Hunting keeps a month. The slow intrusion you wanted to study ages out with it, and production was never a safe place to practise anyway: a query that returns nothing does not tell you whether it is wrong or the tenant is clean. Microsoft gives anyone with a Microsoft account one free Azure Data Explorer (ADX) cluster. No Azure subscription, no credit card, full KQL, about 100 GB of storage. I keep my lab's Defender data in one. By t