TH2.2 The make-series Operator

From events to time series

A sign-in log records that j.morrison signed in at 14:32, 14:47, and 15:03. Those are three events. A time series representation of the same data — with 1-hour bins — says: “hour 14 had 2 sign-ins, hour 15 had 1 sign-in, hour 16 had 0, hour 17 had 0…” The time series includes the zeros. The zeros are the hours where nothing happened — and in hunting, the change from “nothing happening” to “something happening” (or vice versa) is often the signal.

make-series is the KQL operator that performs this transformation.

Basic make-series for hunting

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

// Per-user sign-in volume as a daily time series over 30 days
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| make-series SignInCount = count()
    on TimeGenerated
    from ago(30d) to now()
    step 1d
    by UserPrincipalName
// Each row = one user
// SignInCount = array of 30 values, one per day
// TimeGenerated = array of 30 timestamps (one per day)
// The array includes days with zero sign-ins
// This is the input format for series_decompose_anomalies()

The critical parameters:

step — the bin size. This determines the granularity of the time series. step 1d produces daily bins. step 1h produces hourly bins. step 5m produces 5-minute bins.

Smaller bins reveal finer-grained patterns but produce longer arrays and more noise. Larger bins smooth out noise but may hide short-duration anomalies. The correct bin size depends on the technique:

• Authentication anomalies (TH4): 1-hour bins. AiTM token replay produces bursts of sign-ins within hours. Daily bins would average out the burst.
• Data exfiltration (TH8): 1-day bins. Exfiltration typically sustains over hours or days. Hourly bins produce noise from legitimate work patterns.
• C2 beaconing (TH12): 5-minute or 15-minute bins. Beacon intervals are measured in minutes. Hourly bins would miss the periodicity.

from and to — the time boundaries. Always specify both. Without them, make-series infers boundaries from the data — which means different users may have different time ranges, making comparison impossible.

by — the entity dimension. by UserPrincipalName creates a separate time series per user. by DeviceName creates one per device. by IPAddress creates one per IP. The entity dimension determines what you are profiling.

Fill strategies

By default, make-series fills gaps with zero. In most hunting applications, this is correct — a user who did not sign in on Tuesday has zero sign-ins for that day.

For metrics where zero is not the right default (e.g., session duration, where zero is meaningless), use default=:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

// Average session duration per day — fill gaps with null, not zero
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| extend SessionMinutes = datetime_diff(
    'minute', TimeGenerated, TimeGenerated)
| make-series AvgDuration = avg(SessionMinutes)
    default=real(null)
    on TimeGenerated
    from ago(30d) to now()
    step 1d
    by UserPrincipalName
// null = no data for that day (user did not sign in)
// 0 = user signed in but session duration was zero
// The distinction matters for anomaly detection

make-series for population profiling

Instead of per-entity series, create a single series for the entire population to understand organizational patterns:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

// Organization-wide sign-in volume — daily pattern
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| make-series OrgSignIns = count()
    on TimeGenerated
    from ago(30d) to now()
    step 1d
// One row, one array of 30 daily values
// The pattern shows weekday/weekend cycles, holidays, trends
// This is the organizational baseline that per-entity anomalies
//   are measured against in some campaign modules

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// Hourly pattern for one week — reveals the work day shape
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| make-series HourlySignIns = count()
    on TimeGenerated
    from ago(7d) to now()
    step 1h
// 168 values (7 days × 24 hours)
// The pattern shows: peak hours, off-hours volume, overnight baseline
// Activity outside the normal work pattern is a hunting signal

Figure TH2.2 — Bin size selection for make-series. The technique being hunted determines the appropriate granularity. Each campaign module specifies its bin size.

References Used in This Subsection

• Microsoft. “KQL make-series Operator.” Microsoft Learn. https://learn.microsoft.com/en-us/kusto/query/make-series-operator
• Course cross-references: TH4 (hourly auth series), TH8 (daily download series), TH12 (minute-level beacon series)