Petit test
Guess first, no penalty. An AI-written hunting query returns zero rows for last night. What does that tell you?
In security, an empty result looks exactly like good news. That's why it's dangerous. A query can return nothing because there was nothing, or because it searched the wrong table, a field that's empty in your logs, a time range before your data starts, or the wrong event ID.
So test every new query against a known event before you trust it when it's empty:
- A known event: something you know is in the logs, such as your own failed sign-in from a test account, a lab exercise, or a past incident.
- The data is there: check the table has rows for that time and those event IDs at all.
- Then the real search: once the query finds the known event, an empty result starts to mean something.
AI can draft the test for you. It can't tell you whether your logs hold the data. Only running it does.
A worked example
1. Does the table have the data?
SecurityEvent
| where TimeGenerated between (datetime(2026-10-15 22:00) .. datetime(2026-10-15 23:00))
| summarize count() by EventID
-> 4625 appears: 37 events. The data is there.
2. Does my query find a known event?
I failed 3 test sign-ins as lab.user at 22:40. My query finds them.
3. Only now: run it on last night. Zero rows now means zero matches.Complétez les trous
Fill the gaps.
Test note
Before I trust an empty result, I check , and that the query finds . Only then does zero rows mean .
Try it
Vos étapes, environ 2 minutes
- 1.Take one AI-written query and run it against a time when you know the event happened, in a lab if you can. Add "test on a known event first" to your checklist.2 min