4.2. Graph-Based Hunting
💡 First Principle: Tables answer "what happened?"; graphs answer "what's connected to what?" Attackers think in graphs: from this compromised account, which machines can I log on to, which credentials are cached there, which of those reach a domain admin or a storage account full of customer data? Graph-based hunting lets defenders ask the same questions, so containment covers where the attacker could go, not just where they've been.
Why care: blast radius drives response priorities. Knowing that a compromised help-desk account has a path to the domain controllers changes the incident from routine to critical. The exam's newer objectives (hunting graphs, blast radius, Sentinel graph) test whether you understand relationship analysis as a distinct skill from row-based KQL.
Picture dropping a stone in a pond. The splash is the compromised entity, and the ripples are everything reachable from it: one hop (devices the user signs in to), two hops (accounts with credentials on those devices), three hops (resources those accounts can access). Blast radius is how far the ripples spread before they hit something that stops them.
⚠️ Common Misconception: "The incident graph shows the attack's full blast radius." The incident graph shows only entities correlated into that incident, meaning what the attacker did. Hunting graphs and the Sentinel graph show what the attacker could reach through permissions, sessions, and network paths. Containment scoped only to the incident graph can leave reachable crown jewels unprotected.
