I'm happy to share...
A cross-platform web interface for Microsoft's Kusto Emulator. Develop KQL queries, experiment with graph semantics, and build Kusto applications locally — without provisioning Azure resources or incurring cluster costs.
I'm happy to share:
A native Go implementation of the Vortex columnar file format.
Vortex is a next-generation columnar file format (Linux Foundation project) designed for analytical workloads. It achieves significantly faster scans and better compression than Apache Parquet through adaptive encoding selection and lazy materialisation.
vortex-go provides full read and write support from pure Go — no CGo, no Rust FFI.
The API endpoints, authentication scope, and request format for running KQL against Sentinel's long-term security store.
Persistent sessions, nested MCP support, and a compiled server that deploys as a single binary.
The Model Context Protocol gives Claude the ability to call external tools, and bash execution is one of the most immediately useful. The MCP Bash Server is a Go implementation that provides Claude with a persistent bash session on the host system, allowing it to run commands, build projects, manage files, and interact with the operating environment while maintaining state between calls.
This is quite a big write-up but really quite important to understand as it hints at a different direction for AI automation in 2026.
It's only been a year since Anthropic released Model Context Protocol (MCP), which became the standardised "interface" solution for AI models. Over the Christmas break, Anthropic Skills went live, and I believe they represent the missing piece for reliable AI automation in enterprise environments.
This project demonstrates the usability of an Azure Function App for reliable, continuous scanning for near real-time forwarding of data (using KQL queries) to Log Analytics / Sentinel. This example solution may be also used for KQL forwarding of events to nominated Event Hubs.
I would like to share my collection of PowerShell based Kusto Schema Tools with the community. The tools are written to managing data interchange between Azure Data Explorer (ADX), EventHouse and Microsoft Sentinel.
OPINION: The Sentinel Data Lake is being heavily promoted as a game-changing development in SIEM. After two years of working with Microsoft's technology on a Big Data SIEM, I have a different perspective on this development.
This is a long read but a different assessment to every other perspective I have come across.
It's early days for the Sentinel Data Lake and Microsoft haven't yet released any information about the APIs that are going to be exposed. For the small number of API calls that can be found, the following PowerShell script can provide some access from PowerShell so we can at least get an idea about authentication!