@reprise_99 As a person who is very much biased towards Sentinel and KQL - I would be excited to see if all SIEM platforms could support KQL (given how efficient and effective the language is)
A few days ago I had the idea that an actor could write a cheap ransomware that doesn't encrypt files on a victim's end system.
Imagine they'd only append the extension .crypted & place a ransom note on the desktop.
I bet a significant # of victims would still pay. 🤡