WEBVTT

1
00:00:05.245 --> 00:00:06.415
<00:00:05.245>Yeah, <00:00:05.508>today <00:00:05.771>I <00:00:06.034>actually <00:00:06.298>want

2
00:00:06.415 --> 00:00:08.895
<00:00:06.415>to <00:00:06.531>talk <00:00:06.648>a <00:00:06.765>bit <00:00:06.881>about <00:00:06.998>my <00:00:07.115>journey <00:00:07.231>when <00:00:07.348>it <00:00:07.465>comes <00:00:07.581>to <00:00:07.698>Gen <00:00:07.814>ai

3
00:00:08.955 --> 00:00:11.415
<00:00:08.955>and, <00:00:09.110>um, <00:00:09.266>a <00:00:09.421>couple <00:00:09.577>of <00:00:09.732>the <00:00:09.888>features <00:00:10.043>that <00:00:10.199>I'm <00:00:10.355>developing,

4
00:00:11.955 --> 00:00:13.455
<00:00:11.955>and <00:00:12.147>I <00:00:12.340>hope <00:00:12.533>you're <00:00:12.726>going <00:00:12.919>to <00:00:13.112>enjoy <00:00:13.305>it.

5
00:00:14.915 --> 00:00:17.095
<00:00:14.915>So, <00:00:15.090>maybe <00:00:15.264>just <00:00:15.440>a <00:00:15.614>few <00:00:15.790>words <00:00:15.965>on <00:00:16.140>my <00:00:16.314>side.

6
00:00:17.115 --> 00:00:18.255
<00:00:17.115>Uh, <00:00:17.320>my <00:00:17.525>name <00:00:17.730>is <00:00:17.935>Heen <00:00:18.141>Ra.

7
00:00:19.525 --> 00:00:21.325
<00:00:19.525>Actually, <00:00:19.700>I <00:00:19.875>found <00:00:20.049>out <00:00:20.224>that <00:00:20.400>on <00:00:20.575>this <00:00:20.750>batch, <00:00:20.924>uh,

8
00:00:21.385 --> 00:00:23.725
<00:00:21.385>for <00:00:21.560>this <00:00:21.735>conference, <00:00:21.910>they <00:00:22.085>put <00:00:22.260>me <00:00:22.435>as <00:00:22.610>pro <00:00:22.785>smoke.

9
00:00:24.195 --> 00:00:28.765
<00:00:24.195>It's <00:00:24.335>kind <00:00:24.475>of <00:00:24.615>sticky <00:00:24.755>because, <00:00:24.895>um, <00:00:25.035>part <00:00:25.175>of <00:00:25.315>my, <00:00:25.455>you <00:00:25.595>know,

10
00:00:29.555 --> 00:00:31.605
<00:00:29.555>work <00:00:29.788>at <00:00:30.021>Microsoft, <00:00:30.255>it's <00:00:30.488>actually <00:00:30.721>more <00:00:30.955>like,

11
00:00:31.605 --> 00:00:33.885
<00:00:31.605>more <00:00:31.805>like <00:00:32.005>a <00:00:32.205>side <00:00:32.405>job <00:00:32.604>and <00:00:32.805>an <00:00:33.005>NPCs

12
00:00:33.885 --> 00:00:36.085
<00:00:33.885>or <00:00:34.085>non-player <00:00:34.285>character <00:00:34.485>in, <00:00:34.684>uh, <00:00:34.885>in <00:00:35.085>a <00:00:35.285>game.

13
00:00:36.625 --> 00:00:39.685
<00:00:36.625>So <00:00:36.765>we, <00:00:36.905>as <00:00:37.045>a <00:00:37.185>product <00:00:37.325>group <00:00:37.465>for <00:00:37.605>databases, <00:00:37.745>we <00:00:37.885>create <00:00:38.025>games.

14
00:00:40.365 --> 00:00:42.365
<00:00:40.365>I <00:00:40.520>think <00:00:40.676>we <00:00:40.831>are <00:00:40.987>probably <00:00:41.142>the <00:00:41.298>only <00:00:41.453>ones <00:00:41.609>at <00:00:41.765>Microsoft

15
00:00:42.365 --> 00:00:44.325
<00:00:42.365>who <00:00:42.520>are <00:00:42.676>doing <00:00:42.831>that, <00:00:42.987>and <00:00:43.142>I'm <00:00:43.298>also <00:00:43.453>using <00:00:43.609>that <00:00:43.765>game

16
00:00:44.345 --> 00:00:47.205
<00:00:44.345>to <00:00:44.519>release <00:00:44.695>new <00:00:44.870>features, <00:00:45.045>which <00:00:45.220>is <00:00:45.394>also <00:00:45.570>super <00:00:45.745>cool.

17
00:00:47.505 --> 00:00:50.685
<00:00:47.505>And <00:00:47.632>the <00:00:47.759>last <00:00:47.886>game, <00:00:48.014>uh, <00:00:48.141>that <00:00:48.268>we, <00:00:48.395>that <00:00:48.523>we <00:00:48.650>released <00:00:48.777>was <00:00:48.905>called,

18
00:00:50.865 --> 00:00:53.365
<00:00:50.865>um, <00:00:51.145>call <00:00:51.425>of <00:00:51.705>the <00:00:51.985>Cyber <00:00:52.265>Duty.

19
00:00:54.205 --> 00:00:57.325
<00:00:54.205>I <00:00:54.438>mean, <00:00:54.671>we <00:00:54.905>acquired <00:00:55.138>Activision, <00:00:55.371>so <00:00:55.605>Call

20
00:00:57.325 --> 00:00:58.525
<00:00:57.325>of <00:00:57.541>the <00:00:57.757>Cyber <00:00:57.973>Duty, <00:00:58.189>why <00:00:58.405>not?

21
00:00:59.305 --> 00:01:01.805
<00:00:59.305>Uh, <00:00:59.460>and <00:00:59.616>it <00:00:59.771>was <00:00:59.927>actually <00:01:00.082>a <00:01:00.238>pretty <00:01:00.393>nice <00:01:00.549>event, <00:01:00.705>um,

22
00:01:02.215 --> 00:01:04.445
<00:01:02.215>where <00:01:02.448>you <00:01:02.681>could <00:01:02.915>actually <00:01:03.148>have <00:01:03.381>won <00:01:03.615>$10,000.

23
00:01:04.795 --> 00:01:06.125
<00:01:04.795>It's <00:01:05.034>a <00:01:05.273>capture <00:01:05.513>the <00:01:05.752>flag <00:01:05.992>event.

24
00:01:06.945 --> 00:01:08.085
<00:01:06.945>I'm <00:01:07.116>going <00:01:07.286>to <00:01:07.458>talk <00:01:07.629>about <00:01:07.800>it <00:01:07.971>later.

25
00:01:08.225 --> 00:01:12.325
<00:01:08.225>So, <00:01:08.352>uh, <00:01:08.479>I <00:01:08.606>said <00:01:08.734>in <00:01:08.861>my <00:01:08.988>role, <00:01:09.115>I'm <00:01:09.243>a <00:01:09.370>principal <00:01:09.497>product <00:01:09.625>manager,

26
00:01:12.425 --> 00:01:14.285
<00:01:12.425>so <00:01:12.625>I'm <00:01:12.825>responsible <00:01:13.024>for <00:01:13.225>a <00:01:13.425>couple <00:01:13.625>of <00:01:13.825>features.

27
00:01:14.865 --> 00:01:18.885
<00:01:14.865>Uh, <00:01:14.981>but <00:01:15.098>before <00:01:15.214>I <00:01:15.331>go <00:01:15.448>into <00:01:15.565>the <00:01:15.681>details, <00:01:15.798>who <00:01:15.914>in <00:01:16.031>the <00:01:16.148>crowd <00:01:16.265>knows

28
00:01:19.025 --> 00:01:20.605
<00:01:19.025>or <00:01:19.305>at <00:01:19.585>least <00:01:19.865>heard <00:01:20.145>about <00:01:20.425>cto?

29
00:01:22.865 --> 00:01:26.325
<00:01:22.865>Really <00:01:23.098>nice. <00:01:23.331>So <00:01:23.565>you <00:01:23.798>are <00:01:24.031>my <00:01:24.265>guys.

30
00:01:27.025 --> 00:01:29.445
<00:01:27.025>And <00:01:27.165>then <00:01:27.305>I <00:01:27.445>guess <00:01:27.585>you <00:01:27.725>also <00:01:27.865>heard <00:01:28.005>about <00:01:28.145>Azure <00:01:28.285>Data <00:01:28.425>Explorer,

31
00:01:29.765 --> 00:01:31.965
<00:01:29.765>KQL <00:01:30.231>Fabric, <00:01:30.698>realtime <00:01:31.165>Intelligence.

32
00:01:32.785 --> 00:01:35.725
<00:01:32.785>I'm <00:01:32.912>working <00:01:33.039>at <00:01:33.166>the <00:01:33.294>lowest <00:01:33.421>level <00:01:33.548>in <00:01:33.675>the <00:01:33.803>core <00:01:33.930>of <00:01:34.057>the <00:01:34.185>database,

33
00:01:36.145 --> 00:01:38.685
<00:01:36.145>and <00:01:36.285>I'm <00:01:36.425>responsible <00:01:36.565>for <00:01:36.705>a <00:01:36.845>couple <00:01:36.985>of <00:01:37.125>features <00:01:37.265>at <00:01:37.405>the <00:01:37.545>engine.

34
00:01:39.385 --> 00:01:41.845
<00:01:39.384>Um, <00:01:39.618>for <00:01:39.851>example, <00:01:40.085>I <00:01:40.318>brought <00:01:40.551>geospatial <00:01:40.785>operators

35
00:01:41.865 --> 00:01:43.085
<00:01:41.865>to, <00:01:42.139>uh, <00:01:42.414>to <00:01:42.688>K <00:01:42.963>ql.

36
00:01:43.085 --> 00:01:44.565
<00:01:43.085>So <00:01:43.351>everything <00:01:43.617>that <00:01:43.884>allows <00:01:44.150>you <00:01:44.417>to,

37
00:01:44.705 --> 00:01:46.205
<00:01:44.705>to <00:01:45.155>do <00:01:45.605>geospatial <00:01:46.054>clustering.

38
00:01:46.425 --> 00:01:49.285
<00:01:46.425>I'm <00:01:46.625>responsible <00:01:46.825>for <00:01:47.024>all <00:01:47.225>customer <00:01:47.425>facing <00:01:47.625>security <00:01:47.825>features,

39
00:01:49.785 --> 00:01:52.525
<00:01:49.785>so <00:01:50.065>everything <00:01:50.345>around <00:01:50.625>networking, <00:01:50.905>identity, <00:01:51.185>uh,

40
00:01:52.525 --> 00:01:54.485
<00:01:52.525>permission <00:01:52.805>modeling, <00:01:53.085>that's <00:01:53.365>my <00:01:53.645>home <00:01:53.925>turf.

41
00:01:54.825 --> 00:01:58.165
<00:01:54.825>And <00:01:54.952>recently, <00:01:55.079>I, <00:01:55.206>like <00:01:55.334>two <00:01:55.461>years <00:01:55.588>ago <00:01:55.715>I <00:01:55.843>started <00:01:55.970>a <00:01:56.097>new <00:01:56.225>one,

42
00:01:58.165 --> 00:02:00.045
<00:01:58.164>which <00:01:58.514>is <00:01:58.865>about <00:01:59.214>data <00:01:59.565>contextualization

43
00:02:00.045 --> 00:02:02.445
<00:02:00.045>and <00:02:00.200>graph, <00:02:00.356>which <00:02:00.511>is <00:02:00.667>actually <00:02:00.822>really <00:02:00.978>close <00:02:01.133>to <00:02:01.289>my <00:02:01.445>heart.

44
00:02:03.585 --> 00:02:06.685
<00:02:03.585>Before <00:02:03.725>we <00:02:03.865>go <00:02:04.005>into <00:02:04.145>the <00:02:04.285>fun <00:02:04.425>part <00:02:04.565>of <00:02:04.705>this <00:02:04.845>conference, <00:02:04.985>again,

45
00:02:06.685 --> 00:02:09.525
<00:02:06.685>because <00:02:06.825>of <00:02:06.965>this <00:02:07.105>pro <00:02:07.245>smoke <00:02:07.385>thing, <00:02:07.525>you <00:02:07.665>can <00:02:07.805>still <00:02:07.945>play <00:02:08.085>it.

46
00:02:09.835 --> 00:02:12.765
<00:02:09.835>It's <00:02:09.990>really <00:02:10.146>cool. <00:02:10.301>The, <00:02:10.457>the <00:02:10.612>finishes <00:02:10.768>actually <00:02:10.923>the <00:02:11.079>one <00:02:11.235>who,

47
00:02:12.945 --> 00:02:16.925
<00:02:12.945>the <00:02:13.084>one <00:02:13.225>team <00:02:13.364>who <00:02:13.505>won, <00:02:13.644>uh, <00:02:13.785>10,000 <00:02:13.924>euros, <00:02:14.065>uh, <00:02:14.204>dollars, <00:02:14.345>sorry,

48
00:02:17.505 --> 00:02:18.925
<00:02:17.505>uh, <00:02:17.824>finished <00:02:18.144>in <00:02:18.463>11 <00:02:18.783>hours.

49
00:02:19.105 --> 00:02:23.415
<00:02:19.105>So <00:02:19.280>please, <00:02:19.454>uh, <00:02:19.630>take <00:02:19.804>it <00:02:19.980>and, <00:02:20.155>and <00:02:20.329>have <00:02:20.505>fun.

50
00:02:23.415 --> 00:02:25.375
<00:02:23.415>It's <00:02:23.648>just <00:02:23.881>a <00:02:24.114>really <00:02:24.348>nice <00:02:24.581>learning <00:02:24.815>experience.

51
00:02:27.715 --> 00:02:31.335
<00:02:27.715>So, <00:02:27.842>uh, <00:02:27.969>for <00:02:28.096>those <00:02:28.224>who <00:02:28.351>don't <00:02:28.478>know, <00:02:28.605>kusto <00:02:28.733>in <00:02:28.860>this <00:02:28.987>team, <00:02:29.115>uh,

52
00:02:31.335 --> 00:02:32.415
<00:02:31.335>in <00:02:31.578>this, <00:02:31.821>in <00:02:32.064>this <00:02:32.307>round,

53
00:02:32.445 --> 00:02:36.615
<00:02:32.445>it's <00:02:32.600>a <00:02:32.756>big <00:02:32.911>data <00:02:33.067>analytics <00:02:33.222>cloud <00:02:33.378>platform <00:02:33.533>optimized <00:02:33.689>for, <00:02:33.845>uh,

54
00:02:36.615 --> 00:02:39.295
<00:02:36.615>large <00:02:36.848>streams <00:02:37.081>of <00:02:37.315>data, <00:02:37.548>mostly <00:02:37.781>activity, <00:02:38.015>uh,

55
00:02:39.295 --> 00:02:40.455
<00:02:39.295>records <00:02:39.817>of <00:02:40.339>measurement.

56
00:02:41.125 --> 00:02:42.975
<00:02:41.125>This <00:02:41.405>data <00:02:41.685>comes <00:02:41.965>at <00:02:42.245>Microsoft <00:02:42.525>Scale,

57
00:02:42.975 --> 00:02:45.735
<00:02:42.975>which <00:02:43.174>means <00:02:43.375>high <00:02:43.575>volumes, <00:02:43.775>high <00:02:43.975>velocity, <00:02:44.174>high <00:02:44.375>variety,

58
00:02:45.735 --> 00:02:47.175
<00:02:45.735>everything <00:02:46.059>is <00:02:46.383>pretty <00:02:46.707>much <00:02:47.031>high.

59
00:02:47.915 --> 00:02:52.015
<00:02:47.915>It <00:02:48.070>used <00:02:48.226>to <00:02:48.381>be <00:02:48.537>only, <00:02:48.692>um, <00:02:48.848>uh, <00:02:49.003>relational, <00:02:49.159>uh, <00:02:49.315>engine

60
00:02:52.135 --> 00:02:55.135
<00:02:52.135>with <00:02:52.368>classic <00:02:52.601>relation <00:02:52.834>such <00:02:53.068>as <00:02:53.301>joint <00:02:53.535>projections,

61
00:02:55.135 --> 00:02:56.615
<00:02:55.135>selections, <00:02:55.401>all <00:02:55.667>of <00:02:55.934>that <00:02:56.200>fun <00:02:56.467>stuff.

62
00:02:57.075 --> 00:02:59.285
<00:02:57.075>But <00:02:57.250>we <00:02:57.424>also <00:02:57.600>added <00:02:57.774>now <00:02:57.950>graph <00:02:58.125>stuff <00:02:58.299>to <00:02:58.475>it.

63
00:02:59.595 --> 00:03:02.365
<00:02:59.595>It's <00:02:59.734>a <00:02:59.875>fully <00:03:00.015>managed <00:03:00.155>cloud <00:03:00.295>platform <00:03:00.435>that <00:03:00.575>exists <00:03:00.715>as <00:03:00.855>a <00:03:00.995>pass

64
00:03:02.425 --> 00:03:03.525
<00:03:02.425>or <00:03:02.672>platform <00:03:02.920>as <00:03:03.167>a <00:03:03.415>service.

65
00:03:03.945 --> 00:03:05.605
<00:03:03.945>It <00:03:04.178>exists <00:03:04.411>as <00:03:04.644>software <00:03:04.878>as <00:03:05.111>a <00:03:05.345>service.

66
00:03:06.105 --> 00:03:09.925
<00:03:06.105>You <00:03:06.221>can <00:03:06.338>even <00:03:06.454>have <00:03:06.571>it <00:03:06.688>as <00:03:06.804>a <00:03:06.921>container <00:03:07.038>name <00:03:07.155>for <00:03:07.271>it <00:03:07.388>is <00:03:07.505>er,

67
00:03:10.185 --> 00:03:11.645
<00:03:10.185>we <00:03:10.447>are <00:03:10.710>very <00:03:10.973>creative <00:03:11.236>with <00:03:11.499>names.

68
00:03:12.785 --> 00:03:15.285
<00:03:12.785>As <00:03:12.940>I <00:03:13.096>said, <00:03:13.251>it <00:03:13.407>was <00:03:13.562>purposely <00:03:13.718>built <00:03:13.873>for <00:03:14.029>Microsoft <00:03:14.185>Scale,

69
00:03:15.745 --> 00:03:16.805
<00:03:15.745>uh, <00:03:16.063>11 <00:03:16.381>years <00:03:16.699>ago.

70
00:03:17.305 --> 00:03:19.765
<00:03:17.305>Um, <00:03:17.505>and <00:03:17.705>I <00:03:17.905>would <00:03:18.105>say <00:03:18.305>it's <00:03:18.505>main <00:03:18.705>characteristic.

71
00:03:19.765 --> 00:03:21.365
<00:03:19.765>It's <00:03:20.114>built <00:03:20.464>for <00:03:20.815>interactive <00:03:21.165>workloads.

72
00:03:21.365 --> 00:03:23.645
<00:03:21.365>So <00:03:21.715>rapid <00:03:22.065>iterations, <00:03:22.415>rapid <00:03:22.765>analytics.

73
00:03:25.095 --> 00:03:28.915
<00:03:25.095>Now, <00:03:25.222>before <00:03:25.349>I <00:03:25.476>go <00:03:25.604>into <00:03:25.731>all <00:03:25.858>of <00:03:25.985>this <00:03:26.113>Gen <00:03:26.240>AI <00:03:26.367>fund <00:03:26.495>stuff,

74
00:03:29.575 --> 00:03:32.275
<00:03:29.575>why <00:03:29.730>the <00:03:29.886>heck <00:03:30.041>does <00:03:30.197>anybody <00:03:30.352>want <00:03:30.508>to <00:03:30.663>build <00:03:30.819>graph, <00:03:30.975>uh,

75
00:03:32.275 --> 00:03:34.715
<00:03:32.275>technologies <00:03:32.555>into, <00:03:32.835>into <00:03:33.115>a <00:03:33.395>relational <00:03:33.675>engine?

76
00:03:35.395 --> 00:03:36.595
<00:03:35.395>I <00:03:35.665>mean, <00:03:35.935>in <00:03:36.205>some <00:03:36.475>sense,

77
00:03:36.595 --> 00:03:39.315
<00:03:36.595>relational <00:03:36.795>engines <00:03:36.995>can <00:03:37.195>also <00:03:37.395>be <00:03:37.595>misused <00:03:37.795>as <00:03:37.995>graphs

78
00:03:39.375 --> 00:03:40.835
<00:03:39.375>or <00:03:39.703>even <00:03:40.032>as <00:03:40.360>graph <00:03:40.689>databases.

79
00:03:40.835 --> 00:03:42.555
<00:03:40.835>Some <00:03:41.185>are <00:03:41.535>doing <00:03:41.885>that. <00:03:42.235>Uh,

80
00:03:42.575 --> 00:03:45.155
<00:03:42.575>but <00:03:42.730>actually <00:03:42.886>we <00:03:43.041>were <00:03:43.197>funded <00:03:43.352>by <00:03:43.508>our <00:03:43.663>internal <00:03:43.819>security <00:03:43.975>teams.

81
00:03:45.315 --> 00:03:47.475
<00:03:45.315>I <00:03:45.515>would <00:03:45.715>say <00:03:45.915>probably <00:03:46.115>the <00:03:46.315>majority <00:03:46.515>of, <00:03:46.715>uh,

82
00:03:47.495 --> 00:03:50.675
<00:03:47.495>the <00:03:47.695>world's <00:03:47.895>security <00:03:48.095>data <00:03:48.295>is <00:03:48.495>on <00:03:48.695>this <00:03:48.895>service.

83
00:03:51.295 --> 00:03:55.005
<00:03:51.295>So, <00:03:51.435>and <00:03:51.575>those <00:03:51.715>kind <00:03:51.855>of, <00:03:51.995>um, <00:03:52.135>teams <00:03:52.275>who <00:03:52.415>are <00:03:52.555>building <00:03:52.695>services

84
00:03:55.005 --> 00:03:57.765
<00:03:55.005>around <00:03:55.160>security <00:03:55.316>data, <00:03:55.471>they <00:03:55.627>ask <00:03:55.782>themselves, <00:03:55.938>oh, <00:03:56.093>do <00:03:56.249>we <00:03:56.405>want

85
00:03:57.765 --> 00:04:00.765
<00:03:57.765>to <00:03:57.904>have <00:03:58.045>another <00:03:58.184>Neo <00:03:58.325>four <00:03:58.464>J <00:03:58.605>another <00:03:58.744>spark <00:03:58.885>cluster <00:03:59.024>for, <00:03:59.165>uh,

86
00:04:00.825 --> 00:04:03.605
<00:04:00.825>for <00:04:01.000>graph <00:04:01.174>frames, <00:04:01.350>another <00:04:01.524>graph <00:04:01.700>database <00:04:01.875>on <00:04:02.049>the <00:04:02.225>side,

87
00:04:03.945 --> 00:04:07.005
<00:04:03.945>or <00:04:04.061>do <00:04:04.178>we <00:04:04.295>want <00:04:04.411>to <00:04:04.528>put <00:04:04.644>some, <00:04:04.761>not <00:04:04.878>all <00:04:04.995>of <00:04:05.111>this, <00:04:05.228>uh, <00:04:05.345>goodness

88
00:04:07.005 --> 00:04:09.445
<00:04:07.005>of <00:04:07.180>graph <00:04:07.355>databases <00:04:07.530>directly <00:04:07.704>to <00:04:07.880>where <00:04:08.055>the <00:04:08.230>data <00:04:08.405>sits.

89
00:04:09.665 --> 00:04:11.605
<00:04:09.665>And <00:04:09.840>we <00:04:10.015>were <00:04:10.190>funded <00:04:10.364>actually <00:04:10.540>with <00:04:10.715>the <00:04:10.890>dev <00:04:11.065>team,

90
00:04:12.545 --> 00:04:15.005
<00:04:12.545>and <00:04:12.720>I'm <00:04:12.894>happily <00:04:13.070>doing <00:04:13.244>the <00:04:13.420>product <00:04:13.595>manage <00:04:13.769>management <00:04:13.945>for

91
00:04:15.005 --> 00:04:18.605
<00:04:15.005>that <00:04:15.160>team <00:04:15.316>to <00:04:15.471>actually <00:04:15.627>embed <00:04:15.782>graph <00:04:15.938>technologies <00:04:16.093>deep <00:04:16.249>into <00:04:16.404>the

92
00:04:18.805 --> 00:04:20.085
<00:04:18.805>language, <00:04:19.093>deep <00:04:19.380>into <00:04:19.668>the <00:04:19.957>engine.

93
00:04:20.465 --> 00:04:22.605
<00:04:20.464>And <00:04:20.581>that's <00:04:20.698>an <00:04:20.815>effort <00:04:20.931>that <00:04:21.048>we <00:04:21.164>did <00:04:21.281>now <00:04:21.398>for <00:04:21.515>a <00:04:21.631>couple <00:04:21.748>of <00:04:21.864>years.

94
00:04:22.745 --> 00:04:23.845
<00:04:22.745>So <00:04:22.943>it <00:04:23.141>makes <00:04:23.339>kind <00:04:23.537>of <00:04:23.735>sense

95
00:04:23.845 --> 00:04:27.685
<00:04:23.845>because <00:04:24.078>the <00:04:24.311>gravity <00:04:24.545>is <00:04:24.778>in <00:04:25.011>au <00:04:25.245>actually,

96
00:04:27.685 --> 00:04:31.285
<00:04:27.685>I <00:04:27.825>think <00:04:27.965>we <00:04:28.105>are <00:04:28.245>the <00:04:28.385>biggest <00:04:28.525>consumer <00:04:28.665>of <00:04:28.805>storage <00:04:28.945>at <00:04:29.085>Microsoft,

97
00:04:33.635 --> 00:04:35.925
<00:04:33.635>biggest <00:04:33.914>consumer <00:04:34.195>of <00:04:34.474>storage <00:04:34.755>at <00:04:35.034>Microsoft.

98
00:04:36.465 --> 00:04:40.085
<00:04:36.465>So <00:04:36.592>if <00:04:36.719>you, <00:04:36.846>if <00:04:36.974>you <00:04:37.101>like, <00:04:37.228>consolidate <00:04:37.355>all <00:04:37.483>of <00:04:37.610>your <00:04:37.737>data <00:04:37.865>estate

99
00:04:40.085 --> 00:04:42.605
<00:04:40.085>and <00:04:40.260>you <00:04:40.435>have <00:04:40.609>less <00:04:40.784>databases, <00:04:40.960>cost <00:04:41.135>eventually <00:04:41.310>goes <00:04:41.484>down,

100
00:04:42.605 --> 00:04:44.045
<00:04:42.605>maintenance <00:04:42.864>goes <00:04:43.123>down, <00:04:43.382>you <00:04:43.641>don't <00:04:43.901>need

101
00:04:44.045 --> 00:04:46.325
<00:04:44.045>to <00:04:44.245>manage <00:04:44.445>three <00:04:44.645>different, <00:04:44.845>uh, <00:04:45.045>types <00:04:45.245>of <00:04:45.445>databases.

102
00:04:46.325 --> 00:04:49.045
<00:04:46.325>It's <00:04:46.500>not <00:04:46.675>that. <00:04:46.849>Along <00:04:47.025>the <00:04:47.200>way, <00:04:47.375>we <00:04:47.550>found <00:04:47.724>out

103
00:04:50.405 --> 00:04:51.845
<00:04:50.405>actually <00:04:50.664>we <00:04:50.923>are <00:04:51.182>time <00:04:51.441>series <00:04:51.701>database

104
00:04:52.185 --> 00:04:54.165
<00:04:52.185>and <00:04:52.340>we <00:04:52.496>look <00:04:52.651>at <00:04:52.807>graphs <00:04:52.962>as <00:04:53.118>a <00:04:53.273>series <00:04:53.429>of <00:04:53.585>events

105
00:04:54.225 --> 00:04:56.325
<00:04:54.225>and <00:04:54.400>nodes <00:04:54.575>get <00:04:54.750>added <00:04:54.925>and, <00:04:55.100>and <00:04:55.275>edge <00:04:55.450>gets <00:04:55.625>added.

106
00:04:56.985 --> 00:04:58.085
<00:04:56.985>Things <00:04:57.480>get <00:04:57.974>removed.

107
00:04:58.545 --> 00:05:01.165
<00:04:58.545>So <00:04:58.672>what <00:04:58.799>we <00:04:58.926>are <00:04:59.054>exceptionally <00:04:59.181>well <00:04:59.308>at <00:04:59.435>is <00:04:59.563>looking <00:04:59.690>at <00:04:59.817>the <00:04:59.945>last

108
00:05:01.165 --> 00:05:02.165
<00:05:01.165>known <00:05:01.390>state <00:05:01.615>of <00:05:01.840>a <00:05:02.065>graph,

109
00:05:02.785 --> 00:05:05.365
<00:05:02.785>but <00:05:02.940>we <00:05:03.096>can <00:05:03.251>also <00:05:03.407>go <00:05:03.562>back, <00:05:03.718>um, <00:05:03.873>to <00:05:04.029>the <00:05:04.185>state

110
00:05:05.365 --> 00:05:08.445
<00:05:05.365>of <00:05:05.505>a <00:05:05.645>graph <00:05:05.785>at <00:05:05.925>a <00:05:06.065>specific <00:05:06.205>point <00:05:06.345>in <00:05:06.485>time <00:05:06.625>without <00:05:06.765>explicitly

111
00:05:08.685 --> 00:05:11.965
<00:05:08.685>modeling <00:05:08.840>time <00:05:08.996>in <00:05:09.151>the <00:05:09.307>nodes <00:05:09.462>and <00:05:09.618>edges <00:05:09.773>of <00:05:09.929>a <00:05:10.085>graph.

112
00:05:12.465 --> 00:05:15.885
<00:05:12.465>And <00:05:12.604>for <00:05:12.744>those <00:05:12.885>who <00:05:13.025>know <00:05:13.164>and <00:05:13.304>love <00:05:13.445>query <00:05:13.585>language <00:05:13.724>with <00:05:13.864>all

113
00:05:15.885 --> 00:05:18.805
<00:05:15.885>of <00:05:16.025>its <00:05:16.164>inte <00:05:16.305>sense, <00:05:16.445>goodness, <00:05:16.585>it <00:05:16.724>makes <00:05:16.865>it <00:05:17.005>fun <00:05:17.145>of <00:05:17.284>sense.

114
00:05:19.985 --> 00:05:23.405
<00:05:19.985>So <00:05:20.101>now <00:05:20.218>just <00:05:20.335>two <00:05:20.451>more <00:05:20.568>slides <00:05:20.685>and <00:05:20.801>then <00:05:20.918>we <00:05:21.035>see <00:05:21.151>some, <00:05:21.268>uh, <00:05:21.385>KQL.

115
00:05:24.385 --> 00:05:26.845
<00:05:24.385>You <00:05:24.618>know, <00:05:24.851>embedding <00:05:25.085>graph <00:05:25.318>technology <00:05:25.551>in <00:05:25.784>a,

116
00:05:26.865 --> 00:05:29.965
<00:05:26.865>in <00:05:27.005>a <00:05:27.145>database <00:05:27.285>engine <00:05:27.425>at <00:05:27.565>Microsoft <00:05:27.705>Scale <00:05:27.845>is <00:05:27.985>not <00:05:28.125>that <00:05:28.265>easy.

117
00:05:30.025 --> 00:05:31.605
<00:05:30.025>You <00:05:30.258>need <00:05:30.491>to <00:05:30.724>go <00:05:30.958>through <00:05:31.191>different <00:05:31.424>phases.

118
00:05:31.945 --> 00:05:33.965
<00:05:31.945>So <00:05:32.178>initially <00:05:32.411>we <00:05:32.645>decided <00:05:32.878>to <00:05:33.111>do <00:05:33.344>something,

119
00:05:34.825 --> 00:05:36.725
<00:05:34.825>you <00:05:35.104>can <00:05:35.385>call <00:05:35.664>it <00:05:35.945>graph <00:05:36.224>retrofit.

120
00:05:37.225 --> 00:05:41.125
<00:05:37.225>So <00:05:37.400>whenever <00:05:37.575>there <00:05:37.750>was <00:05:37.925>already <00:05:38.100>an <00:05:38.275>existing <00:05:38.450>tabular <00:05:38.625>expression

121
00:05:41.125 --> 00:05:43.005
<00:05:41.125>that <00:05:41.358>provided <00:05:41.591>you <00:05:41.825>with <00:05:42.058>edges, <00:05:42.291>for <00:05:42.525>example,

122
00:05:43.105 --> 00:05:44.765
<00:05:43.105>and <00:05:43.338>notes, <00:05:43.571>you <00:05:43.805>could <00:05:44.038>just <00:05:44.271>reuse <00:05:44.505>it

123
00:05:45.185 --> 00:05:48.085
<00:05:45.185>and <00:05:45.385>during <00:05:45.585>period <00:05:45.785>time, <00:05:45.985>create <00:05:46.185>an <00:05:46.385>in-memory <00:05:46.585>graph

124
00:05:48.185 --> 00:05:51.525
<00:05:48.185>and <00:05:48.325>then <00:05:48.465>op, <00:05:48.605>um, <00:05:48.745>execute <00:05:48.885>graph <00:05:49.025>operators <00:05:49.165>on <00:05:49.305>top <00:05:49.445>of <00:05:49.585>that.

125
00:05:52.145 --> 00:05:55.245
<00:05:52.145>So <00:05:52.320>whenever <00:05:52.495>there <00:05:52.669>is <00:05:52.844>graphs <00:05:53.020>somewhere <00:05:53.195>in <00:05:53.370>some <00:05:53.544>shape

126
00:05:55.265 --> 00:05:58.165
<00:05:55.265>or <00:05:55.465>form, <00:05:55.664>you <00:05:55.865>can <00:05:56.065>translate <00:05:56.265>it <00:05:56.465>into, <00:05:56.664>um,

127
00:05:59.005 --> 00:06:01.285
<00:05:59.005>a <00:05:59.160>real <00:05:59.316>in-memory <00:05:59.471>graph <00:05:59.627>and <00:05:59.782>operate <00:05:59.938>on <00:06:00.093>top <00:06:00.249>of <00:06:00.405>this.

128
00:06:01.515 --> 00:06:04.205
<00:06:01.515>This <00:06:01.715>is <00:06:01.914>what <00:06:02.115>we <00:06:02.315>released <00:06:02.515>in, <00:06:02.715>uh, <00:06:02.914>2023.

129
00:06:04.395 --> 00:06:07.165
<00:06:04.395>Also <00:06:04.628>part <00:06:04.861>of <00:06:05.094>the <00:06:05.328>acoustic <00:06:05.561>detective <00:06:05.794>agency.

130
00:06:07.225 --> 00:06:09.725
<00:06:07.225>Second <00:06:07.458>season <00:06:07.691>was <00:06:07.925>a <00:06:08.158>really <00:06:08.391>great <00:06:08.625>spike.

131
00:06:10.385 --> 00:06:14.325
<00:06:10.385>Now <00:06:10.560>again, <00:06:10.735>we <00:06:10.909>showed <00:06:11.085>value, <00:06:11.260>so <00:06:11.435>we <00:06:11.610>were <00:06:11.784>funded

132
00:06:14.355 --> 00:06:15.525
<00:06:14.355>with <00:06:14.881>more <00:06:15.407>engineers

133
00:06:16.025 --> 00:06:17.205
<00:06:16.025>and <00:06:16.378>we <00:06:16.733>decided, <00:06:17.087>okay,

134
00:06:17.205 --> 00:06:20.125
<00:06:17.205>let's <00:06:17.438>make <00:06:17.671>CTO <00:06:17.905>graphs <00:06:18.138>first <00:06:18.371>party <00:06:18.604>objects

135
00:06:20.585 --> 00:06:21.605
<00:06:20.585>in <00:06:20.890>the <00:06:21.197>engine <00:06:21.503>itself.

136
00:06:21.665 --> 00:06:23.885
<00:06:21.665>So <00:06:21.840>it's <00:06:22.015>the <00:06:22.190>first <00:06:22.365>time <00:06:22.540>that <00:06:22.715>something <00:06:22.890>else <00:06:23.065>then,

137
00:06:24.175 --> 00:06:26.205
<00:06:24.175>other <00:06:24.525>than <00:06:24.875>Tableau <00:06:25.225>expressions, <00:06:25.575>uh,

138
00:06:26.205 --> 00:06:27.725
<00:06:26.205>like <00:06:26.661>functions <00:06:27.117>materialized <00:06:27.573>views

139
00:06:27.725 --> 00:06:29.525
<00:06:27.725>and <00:06:27.958>stuff <00:06:28.191>made <00:06:28.425>it <00:06:28.658>into <00:06:28.891>the <00:06:29.125>language.

140
00:06:29.945 --> 00:06:33.005
<00:06:29.945>So <00:06:30.120>graphs <00:06:30.295>nowadays <00:06:30.469>are <00:06:30.645>first <00:06:30.820>party <00:06:30.995>citizens <00:06:31.170>in <00:06:31.344>cto.

141
00:06:33.425 --> 00:06:35.525
<00:06:33.425>Uh, <00:06:33.625>it's <00:06:33.825>right <00:06:34.025>now <00:06:34.225>available <00:06:34.425>as <00:06:34.625>public <00:06:34.825>preview.

142
00:06:35.765 --> 00:06:38.285
<00:06:35.765>I <00:06:35.905>announced <00:06:36.044>it, <00:06:36.185>uh, <00:06:36.325>two <00:06:36.465>weeks <00:06:36.604>ago <00:06:36.745>or <00:06:36.885>three <00:06:37.025>weeks <00:06:37.164>ago.

143
00:06:39.025 --> 00:06:40.405
<00:06:39.025>And <00:06:39.232>it <00:06:39.438>has <00:06:39.645>a <00:06:39.852>lot <00:06:40.059>of <00:06:40.267>benefits

144
00:06:40.475 --> 00:06:41.845
<00:06:40.475>that <00:06:40.680>I'm <00:06:40.886>going <00:06:41.091>to <00:06:41.297>talk <00:06:41.502>about <00:06:41.708>later.

145
00:06:43.105 --> 00:06:47.085
<00:06:43.105>Now, <00:06:43.260>let's <00:06:43.416>talk <00:06:43.571>about, <00:06:43.727>I <00:06:43.882>wouldn't <00:06:44.038>call <00:06:44.193>it <00:06:44.349>the <00:06:44.505>downsides,

146
00:06:47.085 --> 00:06:49.725
<00:06:47.085>but <00:06:47.224>if <00:06:47.364>you're <00:06:47.505>building <00:06:47.645>a <00:06:47.784>graph, <00:06:47.924>you <00:06:48.065>somehow <00:06:48.205>need <00:06:48.344>to <00:06:48.484>express

147
00:06:49.905 --> 00:06:51.365
<00:06:49.905>how <00:06:50.123>you <00:06:50.342>want <00:06:50.562>to <00:06:50.781>build <00:06:51.000>that <00:06:51.219>graph.

148
00:06:51.785 --> 00:06:56.325
<00:06:51.784>We <00:06:51.924>decided <00:06:52.064>actually <00:06:52.205>against <00:06:52.344>our <00:06:52.484>nature <00:06:52.624>to <00:06:52.765>have <00:06:52.905>some <00:06:53.044>json <00:06:53.184>uh,

149
00:06:56.385 --> 00:06:58.205
<00:06:56.385>object <00:06:56.735>to <00:06:57.085>represent <00:06:57.435>those <00:06:57.784>graphs.

150
00:06:58.265 --> 00:07:02.365
<00:06:58.265>And <00:06:58.381>this <00:06:58.498>JS <00:06:58.615>objects, <00:06:58.731>which <00:06:58.848>I <00:06:58.965>would <00:06:59.081>refer <00:06:59.198>to <00:06:59.315>as <00:06:59.431>a <00:06:59.548>graph <00:06:59.664>model

151
00:07:02.835 --> 00:07:04.085
<00:07:02.835>that <00:07:03.116>consists <00:07:03.397>of <00:07:03.678>two <00:07:03.960>parts.

152
00:07:04.185 --> 00:07:07.365
<00:07:04.185>The <00:07:04.360>schema <00:07:04.535>you <00:07:04.710>can <00:07:04.885>define, <00:07:05.060>uh, <00:07:05.235>types <00:07:05.410>over <00:07:05.585>there.

153
00:07:07.705 --> 00:07:09.365
<00:07:07.705>Uh, <00:07:08.055>for <00:07:08.405>example, <00:07:08.755>personal <00:07:09.104>employee

154
00:07:09.365 --> 00:07:10.445
<00:07:09.365>with <00:07:09.608>a <00:07:09.851>couple <00:07:10.094>of <00:07:10.337>properties.

155
00:07:10.985 --> 00:07:12.525
<00:07:10.985>And <00:07:11.216>the <00:07:11.447>second <00:07:11.678>part <00:07:11.909>is <00:07:12.140>the <00:07:12.371>definition.

156
00:07:12.545 --> 00:07:14.125
<00:07:12.545>By <00:07:12.778>the <00:07:13.011>way, <00:07:13.245>schema <00:07:13.478>is <00:07:13.711>totally <00:07:13.945>optional.

157
00:07:14.745 --> 00:07:16.605
<00:07:14.745>The <00:07:14.978>step, <00:07:15.211>and <00:07:15.445>in <00:07:15.678>the <00:07:15.911>major <00:07:16.145>part

158
00:07:16.605 --> 00:07:17.925
<00:07:16.605>of <00:07:16.842>the <00:07:17.080>definition <00:07:17.317>is <00:07:17.555>the <00:07:17.793>steps.

159
00:07:18.185 --> 00:07:21.205
<00:07:18.185>So <00:07:18.301>you <00:07:18.418>create <00:07:18.535>the <00:07:18.651>graph <00:07:18.768>in <00:07:18.885>steps, <00:07:19.001>you <00:07:19.118>add <00:07:19.235>nodes <00:07:19.351>as <00:07:19.468>one <00:07:19.585>step,

160
00:07:21.205 --> 00:07:23.405
<00:07:21.205>you <00:07:21.380>add <00:07:21.555>another <00:07:21.729>node <00:07:21.905>step, <00:07:22.080>you <00:07:22.255>add <00:07:22.430>maybe <00:07:22.604>an,

161
00:07:23.465 --> 00:07:24.885
<00:07:23.465>an <00:07:23.720>an <00:07:23.976>edge <00:07:24.231>step <00:07:24.487>down <00:07:24.743>here.

162
00:07:25.425 --> 00:07:27.485
<00:07:25.425>And <00:07:25.658>this <00:07:25.891>when <00:07:26.125>you, <00:07:26.358>when <00:07:26.591>you <00:07:26.825>materialize,

163
00:07:27.485 --> 00:07:29.765
<00:07:27.485>that's <00:07:27.765>quote <00:07:28.045>unquote <00:07:28.325>list <00:07:28.605>of <00:07:28.885>steps

164
00:07:29.865 --> 00:07:31.925
<00:07:29.865>or <00:07:30.040>a <00:07:30.215>script, <00:07:30.390>you <00:07:30.565>get <00:07:30.740>a <00:07:30.915>graph <00:07:31.090>from <00:07:31.265>it.

165
00:07:32.145 --> 00:07:33.685
<00:07:32.145>And <00:07:32.422>we <00:07:32.699>have <00:07:32.976>some <00:07:33.253>weird <00:07:33.531>customers

166
00:07:33.705 --> 00:07:38.125
<00:07:33.705>who <00:07:33.844>have <00:07:33.984>probably <00:07:34.125>60, <00:07:34.265>70, <00:07:34.405>80 <00:07:34.544>different <00:07:34.685>steps, <00:07:34.825>uh, <00:07:34.965>as <00:07:35.104>part

167
00:07:38.125 --> 00:07:39.565
<00:07:38.125>of <00:07:38.449>building, <00:07:38.773>building <00:07:39.097>that <00:07:39.421>graph.

168
00:07:40.185 --> 00:07:43.485
<00:07:40.185>And <00:07:40.312>the <00:07:40.439>rest <00:07:40.566>of <00:07:40.694>the <00:07:40.821>talk <00:07:40.948>actually <00:07:41.075>is <00:07:41.203>going <00:07:41.330>to <00:07:41.457>be <00:07:41.585>about

169
00:07:43.665 --> 00:07:46.325
<00:07:43.665>how <00:07:43.945>do <00:07:44.225>I <00:07:44.505>efficiently <00:07:44.785>or <00:07:45.065>let's,

170
00:07:46.325 --> 00:07:49.525
<00:07:46.325>how <00:07:46.480>do <00:07:46.636>I <00:07:46.791>create <00:07:46.947>my <00:07:47.102>productivity <00:07:47.258>generating <00:07:47.413>such <00:07:47.569>kind <00:07:47.724>of,

171
00:07:49.545 --> 00:07:50.805
<00:07:49.545>uh, <00:07:50.112>J <00:07:50.679>documents.

172
00:07:52.395 --> 00:07:54.445
<00:07:52.395>Okay, <00:07:52.628>so <00:07:52.861>let's <00:07:53.094>do <00:07:53.328>a <00:07:53.561>quick <00:07:53.794>demo.

173
00:07:56.185 --> 00:07:57.925
<00:07:56.185>Um, <00:07:56.535>I <00:07:56.885>mean, <00:07:57.235>I <00:07:57.585>mentioned,

174
00:08:00.045 --> 00:08:04.085
<00:08:00.045>I <00:08:00.185>mentioned <00:08:00.325>a <00:08:00.465>bit <00:08:00.605>about <00:08:00.745>STO <00:08:00.885>scale, <00:08:01.025>uh, <00:08:01.165>in <00:08:01.305>this <00:08:01.445>demo.

175
00:08:04.285 --> 00:08:05.725
<00:08:04.285>I <00:08:04.470>hope <00:08:04.655>you <00:08:04.840>can <00:08:05.025>see <00:08:05.210>it. <00:08:05.395>I'm <00:08:05.581>sorry.

176
00:08:05.785 --> 00:08:07.525
<00:08:05.785>It <00:08:05.985>is, <00:08:06.185>it's <00:08:06.385>not <00:08:06.585>just <00:08:06.785>not <00:08:06.985>big <00:08:07.185>enough.

177
00:08:08.065 --> 00:08:10.805
<00:08:08.065>Um, <00:08:08.265>in <00:08:08.465>Stemo, <00:08:08.665>I'm <00:08:08.865>connected <00:08:09.065>to <00:08:09.265>a <00:08:09.465>cluster

178
00:08:10.835 --> 00:08:12.005
<00:08:10.835>that <00:08:11.186>is <00:08:11.537>called <00:08:11.888>couscous.

179
00:08:12.915 --> 00:08:15.165
<00:08:12.915>It's <00:08:13.115>the <00:08:13.315>CTO <00:08:13.515>cluster <00:08:13.715>of <00:08:13.915>all <00:08:14.115>CTO <00:08:14.315>clusters.

180
00:08:15.505 --> 00:08:17.205
<00:08:15.505>So <00:08:15.738>every <00:08:15.971>CTO <00:08:16.205>cluster <00:08:16.438>on <00:08:16.671>the <00:08:16.905>planet,

181
00:08:17.315 --> 00:08:20.645
<00:08:17.315>it's <00:08:17.490>sending <00:08:17.665>its <00:08:17.840>telemetry <00:08:18.015>data <00:08:18.190>to <00:08:18.365>regional <00:08:18.540>CTO <00:08:18.715>cluster.

182
00:08:20.745 --> 00:08:22.925
<00:08:20.745>And <00:08:20.885>then <00:08:21.025>there <00:08:21.165>is <00:08:21.305>another <00:08:21.445>cluster <00:08:21.585>on <00:08:21.725>top, <00:08:21.865>which <00:08:22.005>is <00:08:22.145>connected

183
00:08:22.925 --> 00:08:24.285
<00:08:22.925>to <00:08:23.169>all <00:08:23.414>of <00:08:23.659>the <00:08:23.904>regional <00:08:24.149>clusters.

184
00:08:24.585 --> 00:08:25.885
<00:08:24.585>And <00:08:24.818>I'm <00:08:25.053>connected <00:08:25.287>to <00:08:25.521>this <00:08:25.755>one.

185
00:08:25.885 --> 00:08:29.885
<00:08:25.885>So <00:08:26.025>when <00:08:26.164>I'm <00:08:26.305>querying <00:08:26.445>this, <00:08:26.585>um, <00:08:26.724>ster <00:08:26.865>logs, <00:08:27.005>uh, <00:08:27.145>dot <00:08:27.284>count,

186
00:08:29.915 --> 00:08:33.045
<00:08:29.915>it's <00:08:30.042>the <00:08:30.169>logs <00:08:30.296>of <00:08:30.424>all <00:08:30.551>kuo <00:08:30.678>clusters <00:08:30.805>of <00:08:30.933>the <00:08:31.060>last <00:08:31.187>28 <00:08:31.315>days.

187
00:08:33.905 --> 00:08:35.525
<00:08:33.905>And <00:08:34.105>then <00:08:34.304>I <00:08:34.505>can <00:08:34.704>just <00:08:34.905>query <00:08:35.105>it <00:08:35.304>live.

188
00:08:35.705 --> 00:08:37.165
<00:08:35.705>And <00:08:35.892>the <00:08:36.080>number <00:08:36.268>is <00:08:36.455>a <00:08:36.643>bit <00:08:36.831>too <00:08:37.019>small,

189
00:08:37.225 --> 00:08:40.635
<00:08:37.225>but <00:08:37.458>it's, <00:08:37.691>uh, <00:08:37.925>uh, <00:08:38.158>million <00:08:38.391>billion <00:08:38.625>trillion,

190
00:08:40.775 --> 00:08:43.315
<00:08:40.775>280 <00:08:40.975>trillion <00:08:41.174>rows <00:08:41.375>that <00:08:41.574>I <00:08:41.775>can <00:08:41.975>query <00:08:42.174>live.

191
00:08:44.535 --> 00:08:45.555
<00:08:44.535>And <00:08:44.688>if <00:08:44.841>we <00:08:44.993>look <00:08:45.146>at <00:08:45.300>the <00:08:45.453>data

192
00:08:45.555 --> 00:08:47.875
<00:08:45.555>that <00:08:45.755>was <00:08:45.954>ingested <00:08:46.155>in <00:08:46.354>the <00:08:46.555>last <00:08:46.755>five <00:08:46.954>days

193
00:08:47.895 --> 00:08:51.035
<00:08:47.895>and <00:08:48.022>take <00:08:48.149>just <00:08:48.276>the, <00:08:48.404>the <00:08:48.531>top <00:08:48.658>cluster, <00:08:48.785>so <00:08:48.913>one <00:08:49.040>cluster <00:08:49.167>was <00:08:49.295>able

194
00:08:51.035 --> 00:08:53.115
<00:08:51.035>to <00:08:51.235>ingest <00:08:51.435>on <00:08:51.635>a <00:08:51.834>single <00:08:52.035>day, <00:08:52.235>six <00:08:52.435>petabyte

195
00:08:53.115 --> 00:08:56.525
<00:08:53.115>of <00:08:53.290>data <00:08:53.465>into <00:08:53.640>a <00:08:53.815>relational <00:08:53.990>database, <00:08:54.165>and <00:08:54.340>it <00:08:54.515>you,

196
00:08:56.525 --> 00:09:00.605
<00:08:56.525>and <00:08:56.680>it <00:08:56.836>was <00:08:56.991>able <00:08:57.147>to <00:08:57.302>compress <00:08:57.458>us <00:08:57.613>to <00:08:57.769>450 <00:08:57.925>terabytes.

197
00:09:00.865 --> 00:09:03.765
<00:09:00.865>You <00:09:00.992>know, <00:09:01.119>we <00:09:01.246>don't <00:09:01.374>rip <00:09:01.501>off <00:09:01.628>our <00:09:01.755>customers <00:09:01.883>off, <00:09:02.010>they <00:09:02.137>only <00:09:02.265>pay

198
00:09:03.765 --> 00:09:05.845
<00:09:03.765>for <00:09:03.998>what <00:09:04.231>they <00:09:04.465>actually <00:09:04.698>store <00:09:04.931>on <00:09:05.165>disk.

199
00:09:06.025 --> 00:09:09.085
<00:09:06.025>So <00:09:06.258>customers <00:09:06.491>pay <00:09:06.725>for <00:09:06.958>this <00:09:07.191>400 <00:09:07.425>terabyte,

200
00:09:09.085 --> 00:09:10.205
<00:09:09.085>it's <00:09:09.253>a <00:09:09.421>column <00:09:09.589>store <00:09:09.757>under <00:09:09.925>the <00:09:10.093>hood,

201
00:09:10.205 --> 00:09:13.125
<00:09:10.205>which <00:09:10.405>has <00:09:10.605>natural <00:09:10.805>compression, <00:09:11.005>but <00:09:11.205>they <00:09:11.405>ingested <00:09:11.605>six.

202
00:09:13.875 --> 00:09:16.245
<00:09:13.875>Okay? <00:09:14.225>So, <00:09:14.575>um, <00:09:14.925>it's <00:09:15.275>kind

203
00:09:16.245 --> 00:09:18.445
<00:09:16.245>of <00:09:16.595>organically <00:09:16.945>grown <00:09:17.295>within <00:09:17.645>Microsoft,

204
00:09:19.015 --> 00:09:20.285
<00:09:19.015>maybe <00:09:19.300>because <00:09:19.586>of <00:09:19.872>that <00:09:20.158>reason.

205
00:09:20.515 --> 00:09:22.165
<00:09:20.515>Okay, <00:09:20.795>customers <00:09:21.074>pay <00:09:21.355>for <00:09:21.635>this <00:09:21.915>part.

206
00:09:23.365 --> 00:09:25.945
<00:09:23.365>So, <00:09:23.505>and <00:09:23.645>then <00:09:23.785>this, <00:09:23.925>the <00:09:24.065>next <00:09:24.205>one <00:09:24.345>is <00:09:24.485>just <00:09:24.625>executed <00:09:24.765>this,

207
00:09:25.945 --> 00:09:27.825
<00:09:25.945>this <00:09:26.120>morning <00:09:26.295>because <00:09:26.470>I <00:09:26.645>wasn't <00:09:26.820>know, <00:09:26.995>I <00:09:27.170>I <00:09:27.345>did,

208
00:09:27.825 --> 00:09:32.185
<00:09:27.825>wasn't <00:09:28.000>really <00:09:28.175>aware <00:09:28.350>of <00:09:28.525>how <00:09:28.700>many, <00:09:28.875>um, <00:09:29.050>how <00:09:29.225>much,

209
00:09:32.205 --> 00:09:33.905
<00:09:32.205>how <00:09:32.405>many <00:09:32.605>cores <00:09:32.805>actually <00:09:33.005>running <00:09:33.205>at <00:09:33.405>the <00:09:33.605>moment.

210
00:09:34.205 --> 00:09:36.225
<00:09:34.205>So, <00:09:34.438>uh, <00:09:34.671>across <00:09:34.905>the <00:09:35.138>entire <00:09:35.371>Azure <00:09:35.605>Cloud,

211
00:09:36.345 --> 00:09:37.625
<00:09:36.345>I <00:09:36.575>don't <00:09:36.805>think <00:09:37.036>the <00:09:37.266>sovereign <00:09:37.497>clouds,

212
00:09:37.625 --> 00:09:39.305
<00:09:37.625>because <00:09:37.858>I'm <00:09:38.091>not <00:09:38.325>connected <00:09:38.558>to <00:09:38.791>sovereign <00:09:39.025>clouds,

213
00:09:39.305 --> 00:09:43.065
<00:09:39.305>here <00:09:39.444>are <00:09:39.584>government <00:09:39.724>clouds <00:09:39.864>right <00:09:40.005>now <00:09:40.145>as <00:09:40.285>we <00:09:40.425>speak <00:09:40.564>here, <00:09:40.704>uh,

214
00:09:43.235 --> 00:09:46.705
<00:09:43.235>7.3 <00:09:43.468>million <00:09:43.701>cores <00:09:43.935>are <00:09:44.168>running <00:09:44.401>this <00:09:44.635>database.

215
00:09:48.185 --> 00:09:51.285
<00:09:48.185>Um, <00:09:48.418>yeah, <00:09:48.651>okay, <00:09:48.885>so <00:09:49.118>far <00:09:49.351>so <00:09:49.584>good.

216
00:09:51.715 --> 00:09:54.765
<00:09:51.715>This <00:09:51.842>is <00:09:51.969>just <00:09:52.096>about <00:09:52.224>the, <00:09:52.351>the <00:09:52.478>scale <00:09:52.605>of, <00:09:52.733>uh, <00:09:52.860>of <00:09:52.987>the, <00:09:53.115>uh,

217
00:09:54.825 --> 00:09:56.445
<00:09:54.825>of <00:09:55.058>the <00:09:55.291>database <00:09:55.525>that <00:09:55.758>we're <00:09:55.991>talking <00:09:56.225>about.

218
00:09:56.885 --> 00:09:58.725
<00:09:56.885>Database <00:09:57.165>system. <00:09:57.444>Let's <00:09:57.725>look <00:09:58.005>at <00:09:58.285>graph.

219
00:09:59.695 --> 00:10:01.835
<00:09:59.695>So <00:09:59.895>sorry, <00:10:00.095>for <00:10:00.295>those <00:10:00.495>who <00:10:00.695>don't <00:10:00.895>know <00:10:01.095>KQL,

220
00:10:01.835 --> 00:10:03.755
<00:10:01.835>this <00:10:02.068>is <00:10:02.301>a <00:10:02.535>crash <00:10:02.768>course <00:10:03.001>in <00:10:03.235>KQL

221
00:10:03.815 --> 00:10:05.595
<00:10:03.815>and <00:10:04.048>you <00:10:04.281>probably <00:10:04.515>want <00:10:04.748>to <00:10:04.981>rewind, <00:10:05.215>like,

222
00:10:05.615 --> 00:10:06.795
<00:10:05.615>and <00:10:05.880>do <00:10:06.146>it <00:10:06.411>slower <00:10:06.676>later.

223
00:10:07.945 --> 00:10:11.875
<00:10:07.945>What <00:10:08.100>you <00:10:08.256>see <00:10:08.411>here <00:10:08.567>is <00:10:08.722>a <00:10:08.878>classic <00:10:09.033>combination <00:10:09.189>of <00:10:09.345>traditional

224
00:10:12.385 --> 00:10:14.915
<00:10:12.385>anomaly <00:10:12.540>detection <00:10:12.696>that <00:10:12.851>comes <00:10:13.007>out <00:10:13.162>of <00:10:13.318>the <00:10:13.473>box <00:10:13.629>with <00:10:13.785>custo.

225
00:10:14.915 --> 00:10:17.155
<00:10:14.915>So <00:10:15.148>time <00:10:15.381>series <00:10:15.615>stuff <00:10:15.848>and <00:10:16.081>graph <00:10:16.314>stuff.

226
00:10:17.325 --> 00:10:19.955
<00:10:17.325>Think <00:10:17.465>about <00:10:17.605>the <00:10:17.745>scenario <00:10:17.885>where <00:10:18.025>you <00:10:18.165>are <00:10:18.305>on <00:10:18.445>a <00:10:18.585>production <00:10:18.725>plan.

227
00:10:19.975 --> 00:10:21.795
<00:10:19.975>You <00:10:20.150>have <00:10:20.325>a <00:10:20.500>conveyor <00:10:20.675>belt <00:10:20.850>on <00:10:21.025>a <00:10:21.200>conveyor <00:10:21.375>belt.

228
00:10:21.795 --> 00:10:24.995
<00:10:21.795>There's <00:10:21.950>a <00:10:22.106>pump, <00:10:22.261>the <00:10:22.417>pump <00:10:22.572>emits, <00:10:22.728>um, <00:10:22.883>uh, <00:10:23.039>pressure <00:10:23.194>sensor.

229
00:10:25.535 --> 00:10:27.075
<00:10:25.535>So <00:10:25.881>certain <00:10:26.228>time <00:10:26.574>series <00:10:26.921>values.

230
00:10:27.615 --> 00:10:30.515
<00:10:27.615>And <00:10:27.731>what <00:10:27.848>you <00:10:27.965>do <00:10:28.081>in <00:10:28.198>the <00:10:28.315>first <00:10:28.431>part <00:10:28.548>is <00:10:28.665>you're <00:10:28.781>just <00:10:28.898>doing <00:10:29.015>a

231
00:10:30.515 --> 00:10:31.555
<00:10:30.515>time <00:10:30.983>series <00:10:31.450>analysis.

232
00:10:31.655 --> 00:10:34.195
<00:10:31.655>You're <00:10:31.935>translating <00:10:32.214>rows <00:10:32.495>into, <00:10:32.775>into <00:10:33.055>vectors.

233
00:10:34.195 --> 00:10:36.875
<00:10:34.195>You <00:10:34.395>do <00:10:34.595>an <00:10:34.795>analysis <00:10:34.995>by <00:10:35.195>filling <00:10:35.395>missing <00:10:35.595>values,

234
00:10:37.055 --> 00:10:40.555
<00:10:37.055>and <00:10:37.255>then <00:10:37.454>you <00:10:37.655>decompose <00:10:37.854>anomalies <00:10:38.055>essentially <00:10:38.255>detect, <00:10:38.454>um,

235
00:10:40.945 --> 00:10:43.515
<00:10:40.945>anomalies <00:10:41.178>using <00:10:41.411>an <00:10:41.645>uni <00:10:41.878>variate <00:10:42.111>anomaly <00:10:42.345>detection.

236
00:10:43.615 --> 00:10:47.595
<00:10:43.615>And <00:10:43.770>then <00:10:43.926>you <00:10:44.081>flag <00:10:44.237>certain <00:10:44.392>assets <00:10:44.548>with, <00:10:44.703>um, <00:10:44.859>with, <00:10:45.015>um,

237
00:10:47.985 --> 00:10:49.875
<00:10:47.985>that <00:10:48.185>it, <00:10:48.385>that <00:10:48.585>it <00:10:48.785>has, <00:10:48.985>uh, <00:10:49.185>an <00:10:49.385>anomaly.

238
00:10:50.335 --> 00:10:53.955
<00:10:50.335>So <00:10:50.451>now <00:10:50.568>that <00:10:50.685>we <00:10:50.801>have <00:10:50.918>a <00:10:51.035>flag, <00:10:51.151>um, <00:10:51.268>uh, <00:10:51.385>assets <00:10:51.501>that <00:10:51.618>are <00:10:51.735>detect

239
00:10:53.955 --> 00:10:56.515
<00:10:53.955>with <00:10:54.235>anomalies, <00:10:54.515>I'm <00:10:54.795>creating <00:10:55.075>my <00:10:55.355>graph.

240
00:10:56.655 --> 00:10:59.115
<00:10:56.655>And <00:10:56.782>the <00:10:56.909>way <00:10:57.036>that <00:10:57.164>I <00:10:57.291>create <00:10:57.418>my <00:10:57.545>graph <00:10:57.673>during <00:10:57.800>query <00:10:57.927>time <00:10:58.055>was,

241
00:10:59.745 --> 00:11:01.235
<00:10:59.745>okay, <00:11:00.013>I <00:11:00.281>take <00:11:00.549>the <00:11:00.817>interesting <00:11:01.086>edges,

242
00:11:01.235 --> 00:11:02.395
<00:11:01.235>doesn't <00:11:01.409>matter <00:11:01.583>where <00:11:01.757>I <00:11:01.931>get <00:11:02.105>them <00:11:02.279>from.

243
00:11:02.785 --> 00:11:05.155
<00:11:02.785>Then <00:11:02.985>I'm <00:11:03.185>using <00:11:03.385>an <00:11:03.584>operator <00:11:03.785>called <00:11:03.985>make <00:11:04.185>graph,

244
00:11:05.925 --> 00:11:08.195
<00:11:05.925>which <00:11:06.125>is <00:11:06.324>saying, <00:11:06.525>okay, <00:11:06.724>take <00:11:06.925>the <00:11:07.125>incoming <00:11:07.324>edges.

245
00:11:08.555 --> 00:11:10.395
<00:11:08.555>'cause <00:11:08.755>without <00:11:08.954>edges, <00:11:09.155>the <00:11:09.354>graph <00:11:09.555>is <00:11:09.755>pretty <00:11:09.954>boring.

246
00:11:11.375 --> 00:11:13.235
<00:11:11.375>Um, <00:11:11.725>and <00:11:12.075>define <00:11:12.425>the <00:11:12.775>source

247
00:11:13.235 --> 00:11:14.915
<00:11:13.235>and <00:11:13.468>destination <00:11:13.701>of <00:11:13.935>the, <00:11:14.168>of <00:11:14.401>the <00:11:14.635>edges

248
00:11:14.935 --> 00:11:17.995
<00:11:14.935>and <00:11:15.109>enrich <00:11:15.285>the <00:11:15.459>nodes <00:11:15.635>with <00:11:15.810>specific <00:11:15.984>information <00:11:16.160>about <00:11:16.334>nodes.

249
00:11:18.295 --> 00:11:20.395
<00:11:18.295>And <00:11:18.435>from <00:11:18.574>that <00:11:18.714>moment <00:11:18.854>on, <00:11:18.995>you <00:11:19.135>can <00:11:19.275>work <00:11:19.415>with <00:11:19.555>a <00:11:19.694>graph.

250
00:11:20.895 --> 00:11:24.315
<00:11:20.895>Um, <00:11:21.069>then <00:11:21.245>we <00:11:21.420>actually <00:11:21.595>took <00:11:21.770>inspiration <00:11:21.944>from <00:11:22.120>languages <00:11:22.295>like

251
00:11:24.315 --> 00:11:25.555
<00:11:24.315>Cipher <00:11:24.687>or <00:11:25.059>Open <00:11:25.430>Cipher

252
00:11:25.575 --> 00:11:28.355
<00:11:25.575>and <00:11:25.775>combine <00:11:25.975>them <00:11:26.175>with <00:11:26.375>our <00:11:26.575>own <00:11:26.775>KQL <00:11:26.975>style.

253
00:11:29.115 --> 00:11:30.655
<00:11:29.115>So <00:11:29.288>what <00:11:29.461>you <00:11:29.634>see <00:11:29.808>here <00:11:29.981>is <00:11:30.154>a <00:11:30.327>graph <00:11:30.501>match

254
00:11:31.205 --> 00:11:33.655
<00:11:31.205>that <00:11:31.405>defines <00:11:31.605>a <00:11:31.805>pattern <00:11:32.005>which <00:11:32.205>connects <00:11:32.405>an <00:11:32.605>asset

255
00:11:34.375 --> 00:11:37.435
<00:11:34.375>to <00:11:34.502>a <00:11:34.629>very <00:11:34.756>length <00:11:34.884>edge <00:11:35.011>to <00:11:35.138>a <00:11:35.265>production <00:11:35.393>line <00:11:35.520>and <00:11:35.647>a <00:11:35.775>factory.

256
00:11:37.775 --> 00:11:40.355
<00:11:37.775>And <00:11:37.930>I'm <00:11:38.086>just <00:11:38.241>interested <00:11:38.397>in <00:11:38.552>assets <00:11:38.708>that <00:11:38.863>have <00:11:39.019>an <00:11:39.175>anomaly

257
00:11:41.095 --> 00:11:44.355
<00:11:41.095>and <00:11:41.328>which, <00:11:41.561>uh, <00:11:41.795>factory <00:11:42.028>lines <00:11:42.261>are <00:11:42.495>factories

258
00:11:44.355 --> 00:11:45.515
<00:11:44.355>and <00:11:44.616>factory <00:11:44.877>lines <00:11:45.138>are <00:11:45.399>impacted.

259
00:11:45.705 --> 00:11:49.235
<00:11:45.705>Very <00:11:45.880>simple <00:11:46.055>stuff. <00:11:46.230>So <00:11:46.405>I <00:11:46.580>can <00:11:46.755>just <00:11:46.930>execute <00:11:47.105>it.

260
00:11:49.335 --> 00:11:50.515
<00:11:49.335>It <00:11:49.512>might <00:11:49.689>take <00:11:49.866>a <00:11:50.043>little <00:11:50.220>bit <00:11:50.396>longer

261
00:11:50.515 --> 00:11:52.675
<00:11:50.515>because <00:11:50.715>the <00:11:50.915>underlying <00:11:51.115>cluster <00:11:51.314>is <00:11:51.515>just <00:11:51.715>being <00:11:51.915>built

262
00:11:52.815 --> 00:11:54.085
<00:11:52.815>as <00:11:53.196>I'm <00:11:53.577>executing <00:11:53.958>it.

263
00:11:54.665 --> 00:11:55.805
<00:11:54.665>So <00:11:54.870>once <00:11:55.075>a <00:11:55.280>cluster <00:11:55.485>is <00:11:55.690>built,

264
00:11:55.805 --> 00:11:57.645
<00:11:55.805>which <00:11:56.038>takes <00:11:56.271>probably <00:11:56.505>3, <00:11:56.738>4, <00:11:56.971>5 <00:11:57.204>seconds,

265
00:11:58.025 --> 00:12:00.685
<00:11:58.025>the <00:11:58.180>query <00:11:58.336>is <00:11:58.491>being <00:11:58.647>executed <00:11:58.802>and <00:11:58.958>just <00:11:59.113>some <00:11:59.269>sample <00:11:59.425>data,

266
00:12:00.785 --> 00:12:02.445
<00:12:00.785>but <00:12:00.985>you <00:12:01.185>know, <00:12:01.385>it's <00:12:01.584>more <00:12:01.785>about <00:12:01.985>the <00:12:02.185>principle.

267
00:12:03.685 --> 00:12:05.865
<00:12:03.685>And <00:12:03.824>then <00:12:03.964>you <00:12:04.104>can <00:12:04.244>also <00:12:04.385>do <00:12:04.525>other <00:12:04.665>things <00:12:04.805>like <00:12:04.944>it's <00:12:05.084>all

268
00:12:05.865 --> 00:12:07.305
<00:12:05.865>about <00:12:06.189>gen <00:12:06.513>AI <00:12:06.837>these <00:12:07.161>days.

269
00:12:07.325 --> 00:12:09.425
<00:12:07.325>So <00:12:07.500>I <00:12:07.675>thought, <00:12:07.850>let's <00:12:08.025>do <00:12:08.200>some <00:12:08.375>gen <00:12:08.550>AI <00:12:08.725>example.

270
00:12:10.555 --> 00:12:13.385
<00:12:10.555>Let's <00:12:10.755>say <00:12:10.954>we <00:12:11.155>have, <00:12:11.354>um, <00:12:11.555>a <00:12:11.755>social <00:12:11.954>network.

271
00:12:13.885 --> 00:12:16.065
<00:12:13.885>People <00:12:14.351>like <00:12:14.818>Pop <00:12:15.285>Eve

272
00:12:16.285 --> 00:12:19.265
<00:12:16.285>and <00:12:16.459>some <00:12:16.635>dummy, <00:12:16.810>they <00:12:16.985>have <00:12:17.160>a <00:12:17.334>geospatial, <00:12:17.510>uh, <00:12:17.685>latitude

273
00:12:19.265 --> 00:12:21.025
<00:12:19.265>and <00:12:19.615>longitudes <00:12:19.965>or <00:12:20.314>geospatial <00:12:20.665>component,

274
00:12:21.405 --> 00:12:23.265
<00:12:21.405>and <00:12:21.638>they <00:12:21.871>also <00:12:22.105>have <00:12:22.338>a <00:12:22.571>biography, <00:12:22.805>right?

275
00:12:23.405 --> 00:12:26.745
<00:12:23.405>The <00:12:23.605>biography <00:12:23.805>is <00:12:24.005>pro, <00:12:24.204>um, <00:12:24.405>uh, <00:12:24.605>is, <00:12:24.805>uh,

276
00:12:26.745 --> 00:12:28.225
<00:12:26.745>is <00:12:27.011>created <00:12:27.277>here <00:12:27.544>as <00:12:27.810>an <00:12:28.077>embedding.

277
00:12:28.225 --> 00:12:30.145
<00:12:28.225>So <00:12:28.458>just <00:12:28.691>assume <00:12:28.925>it's <00:12:29.158>a <00:12:29.391>long <00:12:29.625>vector.

278
00:12:30.885 --> 00:12:34.705
<00:12:30.885>And <00:12:30.985>what <00:12:31.085>I <00:12:31.185>want <00:12:31.285>to <00:12:31.385>do <00:12:31.485>in <00:12:31.585>this <00:12:31.685>query <00:12:31.785>is <00:12:31.885>I <00:12:31.985>want <00:12:32.085>to, <00:12:32.185>I <00:12:32.285>want

279
00:12:34.705 --> 00:12:37.825
<00:12:34.705>to <00:12:34.845>find <00:12:34.985>people <00:12:35.125>who <00:12:35.265>are <00:12:35.405>in <00:12:35.545>some <00:12:35.685>kind <00:12:35.825>of <00:12:35.965>reports <00:12:36.105>relation

280
00:12:38.325 --> 00:12:40.745
<00:12:38.325>and <00:12:38.525>that <00:12:38.725>are <00:12:38.925>in <00:12:39.125>enc <00:12:39.325>close <00:12:39.525>geographic <00:12:39.725>distance,

281
00:12:40.745 --> 00:12:43.505
<00:12:40.745>but <00:12:40.978>also <00:12:41.211>in <00:12:41.445>semantic <00:12:41.678>enclosed <00:12:41.911>semantic <00:12:42.145>distance.

282
00:12:43.965 --> 00:12:47.985
<00:12:43.965>So <00:12:44.105>I <00:12:44.245>can <00:12:44.385>say, <00:12:44.525>compare <00:12:44.665>me, <00:12:44.805>compare <00:12:44.945>the, <00:12:45.085>the <00:12:45.225>biography <00:12:45.365>of

283
00:12:48.515 --> 00:12:50.425
<00:12:48.515>those <00:12:49.215>two <00:12:49.915>employees

284
00:12:50.845 --> 00:12:52.785
<00:12:50.845>and <00:12:51.045>also <00:12:51.245>compare <00:12:51.445>the <00:12:51.645>distance <00:12:51.845>between <00:12:52.045>the <00:12:52.245>two

285
00:12:53.045 --> 00:12:55.865
<00:12:53.045>and <00:12:53.200>only <00:12:53.356>return <00:12:53.511>the <00:12:53.667>ones <00:12:53.822>which <00:12:53.978>are <00:12:54.133>enclosed <00:12:54.289>semantic, <00:12:54.444>um,

286
00:12:56.305 --> 00:12:58.625
<00:12:56.305>distance <00:12:56.584>and <00:12:56.864>also <00:12:57.145>close <00:12:57.425>geographic <00:12:57.704>distance.

287
00:12:59.415 --> 00:13:03.635
<00:12:59.415>Um, <00:12:59.765>yeah. <00:13:00.115>Oh, <00:13:00.464>oops. <00:13:00.814>Okay.

288
00:13:04.335 --> 00:13:08.235
<00:13:04.335>So <00:13:04.510>I <00:13:04.685>would <00:13:04.860>say <00:13:05.035>that's <00:13:05.210>it <00:13:05.385>for, <00:13:05.560>for <00:13:05.735>now.

289
00:13:09.255 --> 00:13:13.515
<00:13:09.255>Uh, <00:13:09.371>when <00:13:09.488>it <00:13:09.605>comes <00:13:09.721>to <00:13:09.838>them, <00:13:09.955>oh, <00:13:10.071>maybe <00:13:10.188>one <00:13:10.305>more <00:13:10.421>thing <00:13:10.538>I <00:13:10.655>wanted

290
00:13:13.515 --> 00:13:16.035
<00:13:13.515>to <00:13:13.748>show <00:13:13.981>you <00:13:14.215>how, <00:13:14.448>how <00:13:14.681>graphs, <00:13:14.915>uh,

291
00:13:16.035 --> 00:13:17.315
<00:13:16.035>when <00:13:16.323>they <00:13:16.611>persisted <00:13:16.899>look <00:13:17.187>like,

292
00:13:17.735 --> 00:13:20.795
<00:13:17.735>and <00:13:17.862>a <00:13:17.989>little <00:13:18.116>bit <00:13:18.244>more <00:13:18.371>like <00:13:18.498>a, <00:13:18.625>a <00:13:18.753>bit <00:13:18.880>more <00:13:19.007>complicated <00:13:19.135>graph.

293
00:13:21.225 --> 00:13:25.395
<00:13:21.225>Okay, <00:13:21.352>I'm <00:13:21.479>sure <00:13:21.606>there <00:13:21.734>are <00:13:21.861>some <00:13:21.988>Game <00:13:22.115>of <00:13:22.243>Thrones <00:13:22.370>people <00:13:22.497>in <00:13:22.625>here

294
00:13:25.455 --> 00:13:27.355
<00:13:25.455>who <00:13:25.688>know <00:13:25.921>at <00:13:26.155>least <00:13:26.388>the, <00:13:26.621>the <00:13:26.855>books,

295
00:13:27.655 --> 00:13:29.795
<00:13:27.655>not <00:13:27.935>necessarily <00:13:28.214>the <00:13:28.495>series <00:13:28.775>TV <00:13:29.055>series.

296
00:13:30.495 --> 00:13:33.515
<00:13:30.495>And <00:13:30.635>Neo <00:13:30.775>four <00:13:30.915>J <00:13:31.055>did <00:13:31.195>a <00:13:31.335>wonderful <00:13:31.475>job <00:13:31.615>in <00:13:31.755>creating, <00:13:31.895>um,

297
00:13:33.715 --> 00:13:36.555
<00:13:33.715>a <00:13:33.870>sample <00:13:34.026>network, <00:13:34.181>uh, <00:13:34.337>at <00:13:34.492>least <00:13:34.648>created <00:13:34.803>blocks <00:13:34.959>about <00:13:35.115>it.

298
00:13:36.895 --> 00:13:39.715
<00:13:36.895>And <00:13:36.995>I'm <00:13:37.095>a <00:13:37.194>big <00:13:37.295>fan, <00:13:37.395>so <00:13:37.495>I, <00:13:37.595>I <00:13:37.694>thought <00:13:37.795>as <00:13:37.895>a <00:13:37.995>fan, <00:13:38.095>I <00:13:38.194>just <00:13:38.295>copy.

299
00:13:40.595 --> 00:13:42.975
<00:13:40.595>So, <00:13:40.735>um, <00:13:40.875>but <00:13:41.015>I, <00:13:41.155>you <00:13:41.295>know, <00:13:41.435>I <00:13:41.575>created <00:13:41.715>my <00:13:41.855>own <00:13:41.995>model.

300
00:13:43.035 --> 00:13:47.095
<00:13:43.035>And <00:13:43.175>you <00:13:43.314>see <00:13:43.454>here, <00:13:43.594>I <00:13:43.735>created <00:13:43.875>notes <00:13:44.015>of <00:13:44.155>how <00:13:44.295>seed <00:13:44.435>title,

301
00:13:47.095 --> 00:13:50.615
<00:13:47.095>character, <00:13:47.328>and <00:13:47.561>a <00:13:47.795>couple <00:13:48.028>of, <00:13:48.261>uh, <00:13:48.495>steps.

302
00:13:51.035 --> 00:13:54.815
<00:13:51.035>So <00:13:51.175>in <00:13:51.314>this <00:13:51.454>step, <00:13:51.594>for <00:13:51.735>example, <00:13:51.875>I <00:13:52.015>run <00:13:52.155>a <00:13:52.295>specific, <00:13:52.435>um,

303
00:13:54.815 --> 00:13:56.575
<00:13:54.815>table <00:13:55.165>expression, <00:13:55.515>which <00:13:55.865>is <00:13:56.215>characters.

304
00:13:56.955 --> 00:14:00.135
<00:13:56.955>I'm <00:13:57.082>extending <00:13:57.209>a <00:13:57.336>note <00:13:57.464>Id, <00:13:57.591>uh, <00:13:57.718>I <00:13:57.845>give <00:13:57.973>it <00:13:58.100>a <00:13:58.227>label <00:13:58.355>character,

305
00:14:00.195 --> 00:14:01.375
<00:14:00.195>and <00:14:00.407>it's <00:14:00.619>a <00:14:00.832>step <00:14:01.044>add <00:14:01.257>notes.

306
00:14:01.805 --> 00:14:04.695
<00:14:01.805>This <00:14:01.960>can <00:14:02.116>be, <00:14:02.271>this <00:14:02.427>can <00:14:02.582>become <00:14:02.738>arbitrary, <00:14:02.893>complex <00:14:03.049>or <00:14:03.204>simple.

307
00:14:05.235 --> 00:14:07.175
<00:14:05.235>For <00:14:05.410>example, <00:14:05.585>this <00:14:05.760>one <00:14:05.935>is <00:14:06.110>a <00:14:06.285>bit <00:14:06.460>more <00:14:06.635>complicated,

308
00:14:07.235 --> 00:14:09.495
<00:14:07.235>so <00:14:07.362>it's <00:14:07.489>a <00:14:07.616>longer <00:14:07.744>query <00:14:07.871>that's <00:14:07.998>just <00:14:08.125>doing <00:14:08.253>a <00:14:08.380>little <00:14:08.507>bit <00:14:08.635>more.

309
00:14:10.355 --> 00:14:12.695
<00:14:10.355>And, <00:14:10.530>you <00:14:10.705>know, <00:14:10.880>that's <00:14:11.055>how <00:14:11.230>graph <00:14:11.405>models <00:14:11.580>look <00:14:11.755>like.

310
00:14:13.205 --> 00:14:15.575
<00:14:13.205>Then <00:14:13.380>once <00:14:13.555>you <00:14:13.730>created <00:14:13.905>those <00:14:14.080>graph <00:14:14.255>models, <00:14:14.430>you <00:14:14.605>have

311
00:14:15.575 --> 00:14:16.575
<00:14:15.575>to <00:14:16.025>materialize <00:14:16.475>them,

312
00:14:16.635 --> 00:14:18.255
<00:14:16.635>or <00:14:16.835>you <00:14:17.035>actually <00:14:17.235>don't <00:14:17.435>have <00:14:17.635>to <00:14:17.835>materialize <00:14:18.035>them,

313
00:14:18.255 --> 00:14:20.015
<00:14:18.255>and <00:14:18.455>then <00:14:18.655>you <00:14:18.855>can <00:14:19.055>work <00:14:19.255>with <00:14:19.455>them <00:14:19.655>just

314
00:14:20.115 --> 00:14:22.895
<00:14:20.115>as <00:14:20.315>if <00:14:20.515>they <00:14:20.715>would <00:14:20.915>be <00:14:21.115>regular, <00:14:21.315>uh, <00:14:21.515>graphs.

315
00:14:23.115 --> 00:14:25.455
<00:14:23.115>So <00:14:23.270>it <00:14:23.426>doesn't <00:14:23.581>matter <00:14:23.737>if <00:14:23.892>those <00:14:24.048>graphs <00:14:24.203>are <00:14:24.359>in <00:14:24.515>memory

316
00:14:25.675 --> 00:14:28.055
<00:14:25.675>or <00:14:25.814>persisted, <00:14:25.954>you <00:14:26.094>can <00:14:26.234>work <00:14:26.375>with <00:14:26.515>them <00:14:26.655>exactly <00:14:26.795>the <00:14:26.935>same <00:14:27.074>way

317
00:14:28.055 --> 00:14:31.775
<00:14:28.055>and <00:14:28.229>it <00:14:28.405>offers <00:14:28.579>quite <00:14:28.755>a <00:14:28.930>ton <00:14:29.104>of, <00:14:29.280>uh, <00:14:29.454>possibilities.

318
00:14:33.605 --> 00:14:34.815
<00:14:33.605>Okay, <00:14:33.877>so <00:14:34.149>let's <00:14:34.421>go <00:14:34.694>back.

319
00:14:36.155 --> 00:14:37.895
<00:14:36.155>So <00:14:36.310>what <00:14:36.466>is <00:14:36.621>it <00:14:36.777>actually <00:14:36.932>that <00:14:37.088>I'm <00:14:37.243>trying <00:14:37.399>to <00:14:37.555>solve?

320
00:14:38.395 --> 00:14:39.535
<00:14:38.395>Uh, <00:14:38.600>this <00:14:38.805>was <00:14:39.010>just <00:14:39.215>the <00:14:39.420>intro

321
00:14:40.275 --> 00:14:44.415
<00:14:40.275>and <00:14:40.430>what <00:14:40.586>I'm <00:14:40.741>trying <00:14:40.897>to <00:14:41.052>solve <00:14:41.208>is <00:14:41.363>a <00:14:41.519>cybersecurity <00:14:41.675>challenge.

322
00:14:44.675 --> 00:14:47.575
<00:14:44.675>Uh, <00:14:44.830>there's <00:14:44.986>one <00:14:45.141>person <00:14:45.297>at <00:14:45.452>Microsoft, <00:14:45.608>which <00:14:45.763>I <00:14:45.919>really <00:14:46.074>admire.

323
00:14:47.715 --> 00:14:49.575
<00:14:47.715>Uh, <00:14:47.915>probably <00:14:48.115>one <00:14:48.315>of <00:14:48.515>the <00:14:48.715>strongest <00:14:48.915>guys <00:14:49.115>at

324
00:14:50.015 --> 00:14:51.055
<00:14:50.015>Microsoft <00:14:50.327>is <00:14:50.639>John <00:14:50.950>Lambert.

325
00:14:51.665 --> 00:14:53.285
<00:14:51.665>He <00:14:51.944>ensures <00:14:52.224>that <00:14:52.505>Microsoft <00:14:52.785>is <00:14:53.064>safe

326
00:14:53.285 --> 00:14:54.565
<00:14:53.285>and <00:14:53.515>probably <00:14:53.745>also <00:14:53.976>a <00:14:54.206>big <00:14:54.437>part

327
00:14:54.565 --> 00:14:57.925
<00:14:54.565>of <00:14:54.705>humanity <00:14:54.845>is <00:14:54.985>safe <00:14:55.125>when <00:14:55.265>it <00:14:55.405>comes <00:14:55.545>to <00:14:55.685>cloud <00:14:55.825>computing, <00:14:55.965>uh,

328
00:14:58.085 --> 00:15:00.485
<00:14:58.085>CVP <00:14:58.260>and <00:14:58.435>CTO <00:14:58.610>of <00:14:58.785>all <00:14:58.960>of <00:14:59.135>our <00:14:59.310>security <00:14:59.485>stuff.

329
00:15:00.905 --> 00:15:03.285
<00:15:00.905>So <00:15:01.138>he <00:15:01.371>says, <00:15:01.605>defender, <00:15:01.838>do <00:15:02.071>think <00:15:02.305>enlist

330
00:15:04.025 --> 00:15:05.365
<00:15:04.025>and <00:15:04.326>attack <00:15:04.628>us <00:15:04.929>thinking <00:15:05.231>graphs.

331
00:15:05.665 --> 00:15:08.205
<00:15:05.665>And <00:15:05.805>as <00:15:05.944>long <00:15:06.084>as <00:15:06.224>this <00:15:06.365>is <00:15:06.505>true, <00:15:06.645>attack <00:15:06.785>us <00:15:06.925>will <00:15:07.064>win.

332
00:15:09.365 --> 00:15:10.805
<00:15:09.365>I <00:15:09.624>believe <00:15:09.883>he's <00:15:10.142>correct <00:15:10.401>on <00:15:10.661>this.

333
00:15:11.345 --> 00:15:14.165
<00:15:11.345>Um, <00:15:11.472>and <00:15:11.599>when <00:15:11.726>I <00:15:11.854>look <00:15:11.981>at <00:15:12.108>the, <00:15:12.235>the <00:15:12.363>classic <00:15:12.490>workflow <00:15:12.617>of <00:15:12.745>how

334
00:15:14.165 --> 00:15:17.085
<00:15:14.165>to <00:15:14.444>inferior <00:15:14.724>graph <00:15:15.005>from <00:15:15.285>Tableau <00:15:15.564>expressions

335
00:15:17.085 --> 00:15:18.845
<00:15:17.085>or <00:15:17.318>from <00:15:17.551>tables, <00:15:17.785>it's <00:15:18.018>actually <00:15:18.251>quite <00:15:18.485>hard.

336
00:15:19.345 --> 00:15:20.685
<00:15:19.345>And <00:15:19.546>I <00:15:19.747>go <00:15:19.948>through <00:15:20.149>that <00:15:20.349>every <00:15:20.550>day.

337
00:15:20.685 --> 00:15:22.685
<00:15:20.685>Like <00:15:20.964>with <00:15:21.244>internal <00:15:21.525>or <00:15:21.805>external <00:15:22.084>customers,

338
00:15:22.715 --> 00:15:23.725
<00:15:22.715>it's <00:15:22.942>always <00:15:23.169>the <00:15:23.396>same, <00:15:23.624>right?

339
00:15:23.725 --> 00:15:25.005
<00:15:23.725>They <00:15:24.013>have <00:15:24.301>the <00:15:24.589>Tableau <00:15:24.877>expressions

340
00:15:25.005 --> 00:15:27.165
<00:15:25.005>and <00:15:25.121>they <00:15:25.238>ask <00:15:25.355>me, <00:15:25.471>he, <00:15:25.588>how <00:15:25.705>can <00:15:25.821>I <00:15:25.938>create <00:15:26.055>the <00:15:26.171>graph <00:15:26.288>from <00:15:26.405>that?

341
00:15:28.695 --> 00:15:31.465
<00:15:28.695>It's <00:15:28.850>not, <00:15:29.006>it's, <00:15:29.161>it's <00:15:29.317>not <00:15:29.472>hard. <00:15:29.628>It's <00:15:29.783>not <00:15:29.939>easy, <00:15:30.095>right?

342
00:15:31.725 --> 00:15:34.345
<00:15:31.725>So <00:15:31.865>most <00:15:32.005>of <00:15:32.145>the <00:15:32.285>time <00:15:32.425>they <00:15:32.565>look <00:15:32.705>at <00:15:32.845>the <00:15:32.985>schema, <00:15:33.125>um,

343
00:15:34.735 --> 00:15:38.425
<00:15:34.735>then <00:15:34.910>they <00:15:35.085>start <00:15:35.260>handcrafting <00:15:35.435>those <00:15:35.610>JS <00:15:35.785>objects, <00:15:35.960>they <00:15:36.135>play

344
00:15:38.425 --> 00:15:41.465
<00:15:38.425>around <00:15:38.580>with <00:15:38.736>it, <00:15:38.891>they <00:15:39.047>find <00:15:39.202>out, <00:15:39.358>okay, <00:15:39.513>it's <00:15:39.669>working <00:15:39.824>great.

345
00:15:41.565 --> 00:15:42.865
<00:15:41.565>So <00:15:41.857>they <00:15:42.150>start <00:15:42.442>writing <00:15:42.735>queries,

346
00:15:42.865 --> 00:15:46.665
<00:15:42.865>and <00:15:43.020>then <00:15:43.176>they <00:15:43.331>see, <00:15:43.487>they <00:15:43.642>see, <00:15:43.798>okay, <00:15:43.953>them, <00:15:44.109>it's <00:15:44.265>crap.

347
00:15:47.225 --> 00:15:48.345
<00:15:47.225>I <00:15:47.426>need <00:15:47.628>to <00:15:47.829>start <00:15:48.031>from <00:15:48.233>scratch.

348
00:15:48.645 --> 00:15:51.905
<00:15:48.645>So <00:15:48.772>it's <00:15:48.899>a <00:15:49.026>lot <00:15:49.154>of <00:15:49.281>iteration, <00:15:49.408>a <00:15:49.535>lot <00:15:49.663>of <00:15:49.790>dumb <00:15:49.917>dumb <00:15:50.045>work

349
00:15:52.015 --> 00:15:55.505
<00:15:52.015>that <00:15:52.215>should <00:15:52.415>actually <00:15:52.615>be <00:15:52.814>done <00:15:53.015>by <00:15:53.215>somebody <00:15:53.415>else.

350
00:15:56.205 --> 00:15:59.185
<00:15:56.205>So <00:15:56.345>somebody <00:15:56.485>that, <00:15:56.625>that <00:15:56.765>really <00:15:56.905>wants <00:15:57.045>to <00:15:57.185>do <00:15:57.325>all <00:15:57.465>of <00:15:57.605>that.

351
00:15:59.725 --> 00:16:02.545
<00:15:59.725>And <00:15:59.841>then <00:15:59.958>at <00:16:00.075>the <00:16:00.191>end <00:16:00.308>of <00:16:00.425>the <00:16:00.541>day, <00:16:00.658>it <00:16:00.775>takes <00:16:00.891>so <00:16:01.008>much <00:16:01.125>time

352
00:16:02.765 --> 00:16:06.425
<00:16:02.765>to <00:16:02.905>create <00:16:03.045>those <00:16:03.185>kinds <00:16:03.324>of <00:16:03.465>rough <00:16:03.605>models <00:16:03.745>compared <00:16:03.885>to <00:16:04.025>the <00:16:04.165>time

353
00:16:06.425 --> 00:16:08.465
<00:16:06.425>that <00:16:06.599>you <00:16:06.775>actually <00:16:06.949>want <00:16:07.125>to <00:16:07.300>spend <00:16:07.474>in <00:16:07.650>analyzing <00:16:07.824>them.

354
00:16:09.485 --> 00:16:14.085
<00:16:09.485>So <00:16:09.612>that's <00:16:09.739>a <00:16:09.866>challenge. <00:16:09.994>So <00:16:10.121>this <00:16:10.248>is <00:16:10.375>exact, <00:16:10.503>this <00:16:10.630>is <00:16:10.757>my <00:16:10.885>journey.

355
00:16:14.115 --> 00:16:15.885
<00:16:14.115>This <00:16:14.315>journey <00:16:14.515>does <00:16:14.715>not <00:16:14.915>have <00:16:15.115>to <00:16:15.315>be <00:16:15.515>true

356
00:16:15.905 --> 00:16:17.205
<00:16:15.905>for <00:16:16.197>anybody <00:16:16.490>else <00:16:16.782>in <00:16:17.075>here.

357
00:16:17.555 --> 00:16:18.805
<00:16:17.555>This <00:16:17.780>is <00:16:18.005>just <00:16:18.229>what <00:16:18.454>I <00:16:18.680>learned.

358
00:16:19.065 --> 00:16:20.165
<00:16:19.065>And <00:16:19.312>some <00:16:19.560>of <00:16:19.807>these, <00:16:20.055>uh,

359
00:16:20.365 --> 00:16:21.805
<00:16:20.365>learnings <00:16:20.527>are <00:16:20.689>going <00:16:20.851>to <00:16:21.013>make <00:16:21.175>it <00:16:21.337>into <00:16:21.498>our <00:16:21.661>product.

360
00:16:22.425 --> 00:16:26.365
<00:16:22.425>So <00:16:22.552>I <00:16:22.679>was <00:16:22.806>using <00:16:22.934>for <00:16:23.061>my, <00:16:23.188>um, <00:16:23.315>experiments, <00:16:23.443>I <00:16:23.570>was <00:16:23.697>using, <00:16:23.824>uh,

361
00:16:26.365 --> 00:16:28.765
<00:16:26.365>GitHub <00:16:26.565>copilot <00:16:26.765>as <00:16:26.965>part <00:16:27.165>of <00:16:27.365>Visual <00:16:27.565>Studio <00:16:27.765>Code,

362
00:16:29.345 --> 00:16:33.205
<00:16:29.345>and <00:16:29.545>I <00:16:29.745>started <00:16:29.945>using <00:16:30.145>the <00:16:30.345>so-called, <00:16:30.545>uh, <00:16:30.745>RTIs

363
00:16:33.205 --> 00:16:35.205
<00:16:33.205>or <00:16:33.405>Realtime <00:16:33.605>Intelligence <00:16:33.805>that's <00:16:34.005>a <00:16:34.205>part <00:16:34.405>of <00:16:34.605>fabric.

364
00:16:35.715 --> 00:16:38.365
<00:16:35.715>They <00:16:35.890>have <00:16:36.065>a <00:16:36.240>specific, <00:16:36.415>um, <00:16:36.590>MCP <00:16:36.765>server, <00:16:36.940>which <00:16:37.115>allows

365
00:16:38.365 --> 00:16:39.685
<00:16:38.365>to <00:16:38.761>run <00:16:39.156>KQL <00:16:39.553>queries.

366
00:16:40.465 --> 00:16:43.965
<00:16:40.465>And <00:16:40.605>I <00:16:40.745>used <00:16:40.885>that <00:16:41.025>one, <00:16:41.165>created <00:16:41.305>a <00:16:41.445>fork <00:16:41.585>and <00:16:41.725>changed <00:16:41.865>stuff.

367
00:16:44.905 --> 00:16:46.485
<00:16:44.905>So <00:16:45.138>I <00:16:45.371>added <00:16:45.605>stuff <00:16:45.838>for, <00:16:46.071>for <00:16:46.305>graph.

368
00:16:46.605 --> 00:16:48.485
<00:16:46.605>I <00:16:46.745>can <00:16:46.885>later <00:16:47.025>on <00:16:47.165>show <00:16:47.305>you <00:16:47.445>what <00:16:47.585>I, <00:16:47.725>what <00:16:47.865>I <00:16:48.005>did.

369
00:16:49.065 --> 00:16:53.045
<00:16:49.065>And <00:16:49.205>then <00:16:49.345>once <00:16:49.485>this <00:16:49.625>graph <00:16:49.765>was <00:16:49.905>being <00:16:50.045>created <00:16:50.185>by <00:16:50.325>the <00:16:50.465>co-pilot

370
00:16:53.045 --> 00:16:56.085
<00:16:53.045>with <00:16:53.200>the <00:16:53.356>help <00:16:53.511>of <00:16:53.667>the <00:16:53.822>MCP <00:16:53.978>server, <00:16:54.133>I <00:16:54.289>was <00:16:54.444>able

371
00:16:56.085 --> 00:16:58.805
<00:16:56.085>to <00:16:56.260>create <00:16:56.435>another <00:16:56.610>MCP <00:16:56.785>server <00:16:56.960>who <00:16:57.135>was <00:16:57.310>actually <00:16:57.485>providing,

372
00:16:59.185 --> 00:17:00.325
<00:16:59.185>uh, <00:16:59.698>best <00:17:00.211>practices.

373
00:17:00.665 --> 00:17:02.445
<00:17:00.665>So <00:17:00.944>nothing <00:17:01.224>else <00:17:01.505>than <00:17:01.785>the <00:17:02.064>work

374
00:17:02.445 --> 00:17:05.525
<00:17:02.445>that <00:17:02.620>I'm <00:17:02.795>usually <00:17:02.970>doing <00:17:03.145>when <00:17:03.320>I'm <00:17:03.495>helping <00:17:03.670>the, <00:17:03.845>the,

375
00:17:05.785 --> 00:17:08.005
<00:17:05.785>the <00:17:05.985>GitHub <00:17:06.185>co-pilot <00:17:06.385>to <00:17:06.585>do <00:17:06.785>its <00:17:06.985>job, <00:17:07.185>okay?

376
00:17:08.325 --> 00:17:10.005
<00:17:08.325>I <00:17:08.558>usually <00:17:08.791>say, <00:17:09.025>oh, <00:17:09.258>come <00:17:09.491>on <00:17:09.725>man,

377
00:17:10.575 --> 00:17:12.445
<00:17:10.575>don't <00:17:10.925>create <00:17:11.275>such <00:17:11.625>complicated <00:17:11.975>models.

378
00:17:13.315 --> 00:17:15.565
<00:17:13.315>Just, <00:17:13.548>you <00:17:13.781>know, <00:17:14.015>create <00:17:14.248>the <00:17:14.481>property <00:17:14.715>back

379
00:17:16.065 --> 00:17:18.765
<00:17:16.065>and <00:17:16.298>make <00:17:16.531>it <00:17:16.765>smaller, <00:17:16.998>not <00:17:17.231>so <00:17:17.465>complicated.

380
00:17:19.465 --> 00:17:22.605
<00:17:19.464>And <00:17:19.592>all <00:17:19.719>of <00:17:19.846>these <00:17:19.974>learnings <00:17:20.101>I <00:17:20.228>put <00:17:20.355>into <00:17:20.483>another <00:17:20.610>MCP <00:17:20.737>server <00:17:20.865>so

381
00:17:22.605 --> 00:17:24.805
<00:17:22.605>that <00:17:22.745>I <00:17:22.885>don't <00:17:23.025>have <00:17:23.165>to <00:17:23.305>do <00:17:23.444>it <00:17:23.585>over <00:17:23.724>and <00:17:23.865>over <00:17:24.005>again,

382
00:17:25.105 --> 00:17:27.245
<00:17:25.105>and <00:17:25.280>I'm, <00:17:25.454>you <00:17:25.630>know, <00:17:25.805>I'm <00:17:25.980>annoyed <00:17:26.155>by <00:17:26.329>such <00:17:26.505>word.

383
00:17:28.705 --> 00:17:32.325
<00:17:28.705>So, <00:17:28.821>as <00:17:28.938>I <00:17:29.054>said, <00:17:29.171>what <00:17:29.288>I <00:17:29.405>added <00:17:29.521>to <00:17:29.638>the, <00:17:29.754>uh, <00:17:29.871>to <00:17:29.988>my <00:17:30.105>fork,

384
00:17:32.395 --> 00:17:35.245
<00:17:32.395>it's <00:17:32.535>going <00:17:32.675>to <00:17:32.815>make <00:17:32.955>it <00:17:33.095>into <00:17:33.235>the <00:17:33.375>product <00:17:33.514>is <00:17:33.655>just <00:17:33.795>some,

385
00:17:35.305 --> 00:17:36.485
<00:17:35.305>uh, <00:17:35.836>model <00:17:36.367>handling.

386
00:17:36.625 --> 00:17:40.365
<00:17:36.625>So <00:17:36.858>show <00:17:37.091>models, <00:17:37.325>um, <00:17:37.558>get <00:17:37.791>model <00:17:38.025>details,

387
00:17:41.015 --> 00:17:43.485
<00:17:41.015>query <00:17:41.248>graph <00:17:41.481>models, <00:17:41.715>sample <00:17:41.948>data <00:17:42.181>and <00:17:42.415>models.

388
00:17:43.545 --> 00:17:46.245
<00:17:43.545>So <00:17:43.778>a <00:17:44.011>few <00:17:44.245>atomic <00:17:44.478>operations, <00:17:44.711>pretty <00:17:44.945>simple.

389
00:17:46.705 --> 00:17:48.725
<00:17:46.705>And <00:17:46.938>then <00:17:47.171>I <00:17:47.405>also <00:17:47.638>told, <00:17:47.871>um, <00:17:48.105>and

390
00:17:49.005 --> 00:17:51.245
<00:17:49.005>provided <00:17:49.285>tools <00:17:49.565>to <00:17:49.845>the <00:17:50.125>GitHub <00:17:50.405>copilot

391
00:17:51.585 --> 00:17:53.245
<00:17:51.585>to <00:17:51.935>query <00:17:52.285>those <00:17:52.635>graphs <00:17:52.985>efficiently.

392
00:17:53.625 --> 00:17:56.005
<00:17:53.625>Use <00:17:53.905>labels <00:17:54.185>function, <00:17:54.465>use <00:17:54.745>graph <00:17:55.025>functions,

393
00:17:56.865 --> 00:17:58.845
<00:17:56.865>and <00:17:57.098>just <00:17:57.331>being <00:17:57.565>better <00:17:57.798>at <00:17:58.031>using <00:17:58.265>graphs.

394
00:18:01.105 --> 00:18:03.325
<00:18:01.105>The <00:18:01.245>other <00:18:01.385>tool <00:18:01.525>that <00:18:01.665>I, <00:18:01.805>that <00:18:01.945>I <00:18:02.085>created, <00:18:02.225>as <00:18:02.365>I <00:18:02.505>said,

395
00:18:03.385 --> 00:18:04.885
<00:18:03.385>is <00:18:03.835>just <00:18:04.285>best <00:18:04.735>practices.

396
00:18:05.505 --> 00:18:08.725
<00:18:05.505>So <00:18:05.645>I <00:18:05.785>told <00:18:05.925>them, <00:18:06.065>come <00:18:06.205>on, <00:18:06.345>schema <00:18:06.485>is <00:18:06.625>optional, <00:18:06.765>don't <00:18:06.905>worry.

397
00:18:09.075 --> 00:18:11.405
<00:18:09.075>Okay? <00:18:09.355>Create <00:18:09.635>simple <00:18:09.915>stuff. <00:18:10.195>Start <00:18:10.475>simple.

398
00:18:12.025 --> 00:18:13.765
<00:18:12.025>Um, <00:18:12.200>and <00:18:12.375>by <00:18:12.550>the <00:18:12.725>way, <00:18:12.900>here <00:18:13.075>are <00:18:13.250>some <00:18:13.425>samples

399
00:18:13.905 --> 00:18:17.325
<00:18:13.905>for <00:18:14.080>some <00:18:14.254>classic <00:18:14.430>cybersecurity <00:18:14.605>graphs, <00:18:14.780>for <00:18:14.955>some <00:18:15.129>iot <00:18:15.305>graphs,

400
00:18:17.745 --> 00:18:19.205
<00:18:17.745>for <00:18:18.073>some <00:18:18.401>social <00:18:18.730>network <00:18:19.059>stuff,

401
00:18:19.825 --> 00:18:22.765
<00:18:19.825>and <00:18:19.980>it <00:18:20.136>just, <00:18:20.291>um, <00:18:20.447>help <00:18:20.602>them, <00:18:20.758>um, <00:18:20.913>creating <00:18:21.069>those <00:18:21.225>graphs

402
00:18:22.945 --> 00:18:26.845
<00:18:22.945>by <00:18:23.145>providing <00:18:23.345>best <00:18:23.544>practices, <00:18:23.745>uh, <00:18:23.945>also <00:18:24.145>around <00:18:24.345>queries

403
00:18:26.845 --> 00:18:29.325
<00:18:26.845>for <00:18:27.020>shortest <00:18:27.195>part <00:18:27.370>that <00:18:27.545>we <00:18:27.720>provide <00:18:27.895>or <00:18:28.070>community <00:18:28.245>detection.

404
00:18:30.395 --> 00:18:35.255
<00:18:30.395>But <00:18:30.595>main <00:18:30.795>mantra <00:18:30.995>is <00:18:31.195>just <00:18:31.395>start <00:18:31.595>simple, <00:18:31.795>okay?

405
00:18:35.715 --> 00:18:37.335
<00:18:35.715>Um, <00:18:35.995>the <00:18:36.274>demo, <00:18:36.554>you <00:18:36.834>know <00:18:37.115>what?

406
00:18:37.395 --> 00:18:40.135
<00:18:37.395>The <00:18:37.595>previous <00:18:37.795>talk, <00:18:37.995>super <00:18:38.195>brave <00:18:38.395>doing <00:18:38.595>everything <00:18:38.795>live.

407
00:18:40.315 --> 00:18:42.615
<00:18:40.315>I'm <00:18:40.470>not <00:18:40.626>that <00:18:40.781>brave, <00:18:40.937>okay? <00:18:41.092>I'm <00:18:41.248>okay <00:18:41.403>with <00:18:41.559>doing <00:18:41.715>it.

408
00:18:42.755 --> 00:18:46.055
<00:18:42.755>Um, <00:18:42.910>the <00:18:43.066>acoustic <00:18:43.221>queries, <00:18:43.377>I <00:18:43.532>think <00:18:43.688>I <00:18:43.843>can <00:18:43.999>handle <00:18:44.155>that.

409
00:18:46.075 --> 00:18:49.375
<00:18:46.075>But, <00:18:46.202>you <00:18:46.329>know, <00:18:46.456>waiting <00:18:46.584>for <00:18:46.711>a <00:18:46.838>client, <00:18:46.965>uh, <00:18:47.093>for, <00:18:47.220>uh, <00:18:47.347>an <00:18:47.475>LLM

410
00:18:49.375 --> 00:18:51.775
<00:18:49.375>to <00:18:49.530>return <00:18:49.686>during <00:18:49.841>the <00:18:49.997>talk, <00:18:50.152>I'm <00:18:50.308>not <00:18:50.463>that <00:18:50.619>brave, <00:18:50.775>okay?

411
00:18:52.355 --> 00:18:53.895
<00:18:52.355>So, <00:18:52.528>but <00:18:52.701>I <00:18:52.874>still, <00:18:53.048>I'm <00:18:53.221>going <00:18:53.394>to <00:18:53.567>tell <00:18:53.741>you

412
00:18:53.895 --> 00:18:55.495
<00:18:53.895>what <00:18:54.095>actually <00:18:54.295>happened <00:18:54.495>and <00:18:54.695>you <00:18:54.895>can <00:18:55.095>trust <00:18:55.295>me.

413
00:18:55.595 --> 00:18:57.455
<00:18:55.595>It <00:18:55.828>happened. <00:18:56.061>This <00:18:56.295>stuff <00:18:56.528>happened <00:18:56.761>for <00:18:56.995>real.

414
00:18:58.275 --> 00:19:01.575
<00:18:58.275>So, <00:18:58.475>um, <00:18:58.675>again, <00:18:58.875>okay, <00:18:59.075>so <00:18:59.275>let's <00:18:59.475>go <00:18:59.675>back

415
00:19:02.715 --> 00:19:04.695
<00:19:02.715>and <00:19:02.915>show <00:19:03.115>you <00:19:03.314>the <00:19:03.514>tables <00:19:03.715>that <00:19:03.915>I <00:19:04.115>have.

416
00:19:06.525 --> 00:19:09.065
<00:19:06.525>Um, <00:19:06.680>so <00:19:06.836>the <00:19:06.991>tables <00:19:07.147>that <00:19:07.302>I <00:19:07.458>have, <00:19:07.613>they're <00:19:07.769>quite <00:19:07.925>simple.

417
00:19:09.285 --> 00:19:13.545
<00:19:09.285>So <00:19:09.412>it's <00:19:09.539>part <00:19:09.666>of <00:19:09.794>a <00:19:09.921>data <00:19:10.048>set <00:19:10.175>that <00:19:10.303>comes <00:19:10.430>from <00:19:10.557>KC <00:19:10.685>seven.

418
00:19:13.925 --> 00:19:17.945
<00:19:13.925>So <00:19:14.041>if <00:19:14.158>you <00:19:14.274>want <00:19:14.391>to <00:19:14.508>do <00:19:14.625>other <00:19:14.741>capture <00:19:14.858>the <00:19:14.975>flag <00:19:15.091>games, <00:19:15.208>go <00:19:15.325>to

419
00:19:19.065 --> 00:19:22.405
<00:19:19.065>KC <00:19:19.240>seven <00:19:19.415>dot <00:19:19.590>uh, <00:19:19.765>dot <00:19:19.940>com, <00:19:20.115>KC <00:19:20.290>seven <00:19:20.465>cyber.com.

420
00:19:22.405 --> 00:19:25.125
<00:19:22.405>It's <00:19:22.605>a <00:19:22.805>cybersecurity <00:19:23.004>game <00:19:23.205>where <00:19:23.405>you <00:19:23.605>learn <00:19:23.805>how

421
00:19:25.125 --> 00:19:28.605
<00:19:25.125>to <00:19:25.280>do <00:19:25.436>cybersecurity, <00:19:25.591>the <00:19:25.747>Microsoft <00:19:25.902>style, <00:19:26.058>it's <00:19:26.213>also <00:19:26.369>done <00:19:26.525>by,

422
00:19:28.605 --> 00:19:30.605
<00:19:28.605>by <00:19:28.955>Microsoft, <00:19:29.305>um, <00:19:29.655>uh, <00:19:30.005>people.

423
00:19:30.955 --> 00:19:32.685
<00:19:30.955>It's <00:19:31.304>actually <00:19:31.655>an <00:19:32.004>amazing <00:19:32.355>source.

424
00:19:33.145 --> 00:19:36.245
<00:19:33.145>And <00:19:33.285>they <00:19:33.425>generated <00:19:33.565>all <00:19:33.705>of <00:19:33.845>this <00:19:33.985>data <00:19:34.125>as <00:19:34.264>you <00:19:34.405>see, <00:19:34.545>application,

425
00:19:36.245 --> 00:19:40.805
<00:19:36.245>events, <00:19:36.445>emails, <00:19:36.645>employees, <00:19:36.844>um, <00:19:37.044>passive <00:19:37.245>DNS <00:19:37.445>requests, <00:19:37.645>post,

426
00:19:40.945 --> 00:19:42.165
<00:19:40.945>um, <00:19:41.494>process <00:19:42.043>events.

427
00:19:42.465 --> 00:19:44.085
<00:19:42.465>And <00:19:42.605>then <00:19:42.745>you <00:19:42.885>can <00:19:43.024>just <00:19:43.165>look <00:19:43.304>at <00:19:43.445>a <00:19:43.584>couple <00:19:43.725>of <00:19:43.865>them.

428
00:19:44.145 --> 00:19:47.005
<00:19:44.145>You <00:19:44.345>see, <00:19:44.545>a <00:19:44.745>timestamp <00:19:44.945>is <00:19:45.145>not <00:19:45.345>really <00:19:45.545>realistic,

429
00:19:47.005 --> 00:19:48.125
<00:19:47.005>it's <00:19:47.341>all <00:19:47.677>generated <00:19:48.013>stuff,

430
00:19:48.505 --> 00:19:52.165
<00:19:48.505>but <00:19:48.660>you <00:19:48.816>have <00:19:48.971>interesting, <00:19:49.127>um, <00:19:49.282>column <00:19:49.438>seal, <00:19:49.593>like <00:19:49.749>host <00:19:49.905>names,

431
00:19:52.165 --> 00:19:55.045
<00:19:52.165>source <00:19:52.398>ips <00:19:52.631>information <00:19:52.865>about <00:19:53.098>the <00:19:53.331>user <00:19:53.565>agent.

432
00:19:55.545 --> 00:19:57.725
<00:19:55.545>So <00:19:55.700>creating <00:19:55.856>that <00:19:56.011>kind <00:19:56.167>of <00:19:56.322>data <00:19:56.478>set <00:19:56.633>is <00:19:56.789>some <00:19:56.945>effort.

433
00:19:57.915 --> 00:20:00.125
<00:19:57.915>Same <00:19:58.115>for <00:19:58.315>like <00:19:58.514>passive <00:19:58.715>d <00:19:58.915>and <00:19:59.115>s <00:19:59.315>stuff

434
00:20:00.145 --> 00:20:03.325
<00:20:00.145>and <00:20:00.272>IP <00:20:00.399>to <00:20:00.526>a <00:20:00.654>domain, <00:20:00.781>uh, <00:20:00.908>to <00:20:01.035>a <00:20:01.163>domain, <00:20:01.290>including <00:20:01.417>a <00:20:01.545>timestamp.

435
00:20:03.795 --> 00:20:05.325
<00:20:03.795>It's <00:20:04.024>actually <00:20:04.254>quite <00:20:04.483>a <00:20:04.713>nice <00:20:04.942>data <00:20:05.172>set,

436
00:20:05.325 --> 00:20:08.605
<00:20:05.325>but <00:20:05.465>I <00:20:05.605>don't <00:20:05.745>have <00:20:05.885>any <00:20:06.025>clue <00:20:06.165>how <00:20:06.305>I <00:20:06.445>could <00:20:06.585>compose <00:20:06.725>all

437
00:20:08.605 --> 00:20:10.885
<00:20:08.605>of <00:20:08.805>this <00:20:09.005>tabular <00:20:09.205>stuff <00:20:09.405>into <00:20:09.605>a <00:20:09.805>nice <00:20:10.005>graph.

438
00:20:11.065 --> 00:20:12.205
<00:20:11.065>And <00:20:11.321>there <00:20:11.578>I <00:20:11.834>need <00:20:12.091>help.

439
00:20:12.985 --> 00:20:16.205
<00:20:12.985>So <00:20:13.159>I <00:20:13.334>went <00:20:13.510>back <00:20:13.685>to <00:20:13.860>my <00:20:14.034>friend, <00:20:14.209>the <00:20:14.385>co-pilot

440
00:20:16.945 --> 00:20:20.845
<00:20:16.945>and <00:20:17.100>asked, <00:20:17.256>Hey, <00:20:17.411>can <00:20:17.567>you <00:20:17.722>please <00:20:17.878>check <00:20:18.033>the <00:20:18.189>WAT <00:20:18.345>database?

441
00:20:21.545 --> 00:20:26.525
<00:20:21.545>Um, <00:20:21.685>and <00:20:21.825>if <00:20:21.965>it <00:20:22.105>could <00:20:22.245>be <00:20:22.385>used <00:20:22.525>for <00:20:22.665>any <00:20:22.805>cybersecurity <00:20:22.945>scenarios,

442
00:20:27.025 --> 00:20:29.365
<00:20:27.025>and <00:20:27.180>it <00:20:27.336>did <00:20:27.491>the <00:20:27.647>same <00:20:27.802>thing <00:20:27.958>that <00:20:28.113>I <00:20:28.269>just <00:20:28.425>did.

443
00:20:29.425 --> 00:20:32.725
<00:20:29.425>So <00:20:29.580>it <00:20:29.736>went <00:20:29.891>and <00:20:30.047>went <00:20:30.202>to <00:20:30.358>the <00:20:30.513>cluster, <00:20:30.669>hello <00:20:30.825>cluster.

444
00:20:32.725 --> 00:20:34.125
<00:20:32.725>What <00:20:32.935>kind <00:20:33.145>of <00:20:33.355>databases <00:20:33.565>do <00:20:33.775>you <00:20:33.985>have?

445
00:20:34.125 --> 00:20:36.285
<00:20:34.125>It <00:20:34.300>listed <00:20:34.475>a <00:20:34.650>databases, <00:20:34.825>then <00:20:35.000>it <00:20:35.175>listed <00:20:35.350>a <00:20:35.525>tables,

446
00:20:36.945 --> 00:20:41.165
<00:20:36.945>it <00:20:37.072>got <00:20:37.199>the <00:20:37.326>table <00:20:37.454>schema, <00:20:37.581>and <00:20:37.708>it <00:20:37.835>just <00:20:37.963>analyzed <00:20:38.090>all <00:20:38.217>of <00:20:38.345>it.

447
00:20:41.665 --> 00:20:44.885
<00:20:41.665>Um, <00:20:41.820>and <00:20:41.976>then <00:20:42.131>it <00:20:42.287>created <00:20:42.442>this <00:20:42.598>nice <00:20:42.753>breakdown, <00:20:42.909>okay, <00:20:43.065>you,

448
00:20:44.905 --> 00:20:46.405
<00:20:44.905>you <00:20:45.175>seem <00:20:45.445>to <00:20:45.715>have <00:20:45.985>authentication <00:20:46.254>events.

449
00:20:46.475 --> 00:20:47.525
<00:20:46.475>This <00:20:46.790>is <00:20:47.105>the <00:20:47.420>schema.

450
00:20:47.815 --> 00:20:49.045
<00:20:47.815>There <00:20:48.091>might <00:20:48.368>be <00:20:48.645>some <00:20:48.922>higher

451
00:20:49.145 --> 00:20:51.085
<00:20:49.145>or <00:20:49.425>low <00:20:49.705>value <00:20:49.985>for <00:20:50.264>cybersecurity <00:20:50.545>stuff.

452
00:20:51.505 --> 00:20:53.925
<00:20:51.505>It <00:20:51.738>classified <00:20:51.971>certain <00:20:52.205>tables <00:20:52.438>through <00:20:52.671>specific <00:20:52.905>things.

453
00:20:53.985 --> 00:20:56.365
<00:20:53.985>So <00:20:54.218>actually <00:20:54.451>quite <00:20:54.685>nice, <00:20:54.918>uh, <00:20:55.151>nice <00:20:55.385>work.

454
00:20:56.385 --> 00:21:00.215
<00:20:56.385>And <00:20:56.540>then <00:20:56.696>it <00:20:56.851>also <00:20:57.007>explained <00:20:57.162>me <00:20:57.318>all <00:20:57.473>of <00:20:57.629>the <00:20:57.785>scenarios

455
00:21:00.215 --> 00:21:03.455
<00:21:00.215>that <00:21:00.415>might <00:21:00.615>be <00:21:00.814>applicable, <00:21:01.014>like <00:21:01.215>advanced <00:21:01.415>threat <00:21:01.615>protection,

456
00:21:04.005 --> 00:21:06.615
<00:21:04.005>insider <00:21:04.238>threat <00:21:04.471>protection, <00:21:04.705>phishing, <00:21:04.938>and <00:21:05.171>email <00:21:05.405>security.

457
00:21:06.955 --> 00:21:08.215
<00:21:06.955>And <00:21:07.144>then <00:21:07.332>I <00:21:07.522>went <00:21:07.711>back <00:21:07.899>to <00:21:08.089>it

458
00:21:08.215 --> 00:21:09.415
<00:21:08.215>and <00:21:08.485>say, <00:21:08.754>okay, <00:21:09.024>come <00:21:09.295>on,

459
00:21:10.325 --> 00:21:11.855
<00:21:10.325>what <00:21:10.600>would <00:21:10.875>be <00:21:11.151>nice <00:21:11.426>entry <00:21:11.702>level

460
00:21:12.175 --> 00:21:13.215
<00:21:12.175>scenario <00:21:12.362>that <00:21:12.549>we <00:21:12.736>could <00:21:12.923>start <00:21:13.110>with?

461
00:21:13.425 --> 00:21:17.015
<00:21:13.425>Don't <00:21:13.625>overwhelm <00:21:13.825>me <00:21:14.024>with <00:21:14.225>like <00:21:14.425>super <00:21:14.625>complicated <00:21:14.825>stuff.

462
00:21:17.065 --> 00:21:18.375
<00:21:17.065>Let's <00:21:17.359>just <00:21:17.654>do <00:21:17.949>something <00:21:18.244>simple.

463
00:21:19.475 --> 00:21:23.295
<00:21:19.475>So <00:21:19.615>again, <00:21:19.754>it <00:21:19.895>went <00:21:20.034>back, <00:21:20.175>uh, <00:21:20.314>this <00:21:20.455>new <00:21:20.594>MCP <00:21:20.735>server <00:21:20.875>fork,

464
00:21:23.755 --> 00:21:25.695
<00:21:23.755>it <00:21:24.105>created <00:21:24.455>existing <00:21:24.805>graph <00:21:25.155>models.

465
00:21:26.025 --> 00:21:27.775
<00:21:26.025>There <00:21:26.305>were <00:21:26.585>no <00:21:26.865>existing <00:21:27.145>graph <00:21:27.425>models,

466
00:21:27.875 --> 00:21:29.455
<00:21:27.875>and <00:21:28.108>then <00:21:28.341>it <00:21:28.575>asked <00:21:28.808>for <00:21:29.041>best <00:21:29.275>practices.

467
00:21:29.455 --> 00:21:31.215
<00:21:29.455>So <00:21:29.688>it <00:21:29.921>used <00:21:30.155>a <00:21:30.388>second <00:21:30.621>MCP <00:21:30.855>server

468
00:21:31.795 --> 00:21:34.775
<00:21:31.795>and <00:21:31.935>its <00:21:32.075>tools <00:21:32.215>to <00:21:32.355>ask <00:21:32.495>for, <00:21:32.635>Hey, <00:21:32.775>what <00:21:32.915>could <00:21:33.055>be <00:21:33.195>things

469
00:21:35.005 --> 00:21:36.735
<00:21:35.005>that <00:21:35.180>I <00:21:35.355>could <00:21:35.530>do <00:21:35.705>with <00:21:35.880>this <00:21:36.055>kind <00:21:36.230>of <00:21:36.405>data?

470
00:21:37.155 --> 00:21:39.415
<00:21:37.155>And <00:21:37.330>it <00:21:37.504>also <00:21:37.680>asked <00:21:37.855>for <00:21:38.030>graph <00:21:38.205>match <00:21:38.379>guidance, <00:21:38.555>it,

471
00:21:39.835 --> 00:21:41.935
<00:21:39.835>and <00:21:40.035>then <00:21:40.235>it <00:21:40.435>created <00:21:40.635>a <00:21:40.835>nice <00:21:41.035>breakdown, <00:21:41.235>okay?

472
00:21:42.555 --> 00:21:44.855
<00:21:42.555>An <00:21:42.755>entry <00:21:42.955>level <00:21:43.155>thing <00:21:43.355>should <00:21:43.555>be <00:21:43.755>lateral <00:21:43.955>movement.

473
00:21:44.875 --> 00:21:47.095
<00:21:44.875>So <00:21:45.108>somebody's <00:21:45.341>locking <00:21:45.575>onto <00:21:45.808>a <00:21:46.041>virtual <00:21:46.275>machine,

474
00:21:47.095 --> 00:21:48.295
<00:21:47.095>so <00:21:47.365>if <00:21:47.635>an <00:21:47.905>authentication <00:21:48.175>event

475
00:21:48.295 --> 00:21:50.255
<00:21:48.295>and <00:21:48.495>then <00:21:48.695>just <00:21:48.895>hops <00:21:49.095>from <00:21:49.295>those <00:21:49.495>virtual <00:21:49.695>machines

476
00:21:50.255 --> 00:21:52.735
<00:21:50.255>to <00:21:50.488>other <00:21:50.721>things, <00:21:50.955>that's <00:21:51.188>a <00:21:51.421>lateral <00:21:51.655>movement.

477
00:21:53.715 --> 00:21:56.895
<00:21:53.715>Um, <00:21:53.870>and <00:21:54.026>you <00:21:54.181>know, <00:21:54.337>it's <00:21:54.492>a, <00:21:54.648>it <00:21:54.803>told <00:21:54.959>me, <00:21:55.115>okay,

478
00:21:57.085 --> 00:22:00.055
<00:21:57.085>perfect <00:21:57.318>entry <00:21:57.551>level <00:21:57.785>stuff, <00:21:58.018>high <00:21:58.251>privilege <00:21:58.485>accounts

479
00:22:00.685 --> 00:22:04.415
<00:22:00.685>that <00:22:00.885>are <00:22:01.085>maybe <00:22:01.284>administrative <00:22:01.485>accounts <00:22:01.685>to <00:22:01.885>lateral <00:22:02.085>movement,

480
00:22:04.435 --> 00:22:06.935
<00:22:04.435>and <00:22:04.668>this <00:22:04.901>might <00:22:05.135>be <00:22:05.368>some <00:22:05.601>suspicious <00:22:05.835>behavior.

481
00:22:07.315 --> 00:22:08.615
<00:22:07.315>So <00:22:07.482>it <00:22:07.649>explained <00:22:07.816>me <00:22:07.983>all <00:22:08.150>of <00:22:08.317>this <00:22:08.485>stuff,

482
00:22:08.615 --> 00:22:11.815
<00:22:08.615>and <00:22:08.755>it <00:22:08.895>created <00:22:09.035>me <00:22:09.175>immediately <00:22:09.315>a <00:22:09.455>nice, <00:22:09.595>uh, <00:22:09.735>a <00:22:09.875>nice <00:22:10.015>model

483
00:22:11.835 --> 00:22:13.095
<00:22:11.835>and <00:22:12.024>I <00:22:12.213>just <00:22:12.402>had <00:22:12.591>to <00:22:12.780>copy <00:22:12.969>it,

484
00:22:13.355 --> 00:22:14.975
<00:22:13.355>or <00:22:13.635>I <00:22:13.915>could <00:22:14.195>also <00:22:14.475>immediately <00:22:14.755>trigger

485
00:22:15.035 --> 00:22:16.215
<00:22:15.035>the <00:22:15.247>creation <00:22:15.459>of <00:22:15.672>the <00:22:15.884>graph <00:22:16.097>model.

486
00:22:17.095 --> 00:22:20.475
<00:22:17.095>So <00:22:17.235>all <00:22:17.375>of <00:22:17.515>my <00:22:17.655>work, <00:22:17.795>all <00:22:17.935>of, <00:22:18.075>let's <00:22:18.215>say, <00:22:18.355>my <00:22:18.495>knowledge

487
00:22:20.475 --> 00:22:23.315
<00:22:20.475>that <00:22:20.649>acquired <00:22:20.824>over <00:22:21.000>the <00:22:21.175>past <00:22:21.350>couple <00:22:21.524>of <00:22:21.699>months <00:22:21.875>maybe,

488
00:22:23.415 --> 00:22:26.635
<00:22:23.415>or <00:22:23.555>maybe <00:22:23.695>even <00:22:23.835>years, <00:22:23.975>I <00:22:24.115>put <00:22:24.254>that <00:22:24.395>into <00:22:24.534>that <00:22:24.675>MCP <00:22:24.815>server

489
00:22:26.695 --> 00:22:29.315
<00:22:26.695>and <00:22:26.850>now <00:22:27.006>can <00:22:27.161>do <00:22:27.317>like <00:22:27.472>more <00:22:27.628>productive <00:22:27.783>stuff, <00:22:27.939>other <00:22:28.095>stuff.

490
00:22:29.615 --> 00:22:30.675
<00:22:29.615>And <00:22:29.805>I <00:22:29.996>don't <00:22:30.187>have <00:22:30.378>to <00:22:30.569>worry

491
00:22:30.695 --> 00:22:33.855
<00:22:30.695>and <00:22:30.870>always <00:22:31.044>tell <00:22:31.220>the <00:22:31.395>agent, <00:22:31.570>do <00:22:31.745>this, <00:22:31.919>do <00:22:32.095>that.

492
00:22:33.965 --> 00:22:37.735
<00:22:33.965>Okay? <00:22:34.072>So <00:22:34.180>this <00:22:34.288>was <00:22:34.395>for <00:22:34.503>me <00:22:34.611>already <00:22:34.718>a <00:22:34.826>big, <00:22:34.934>a <00:22:35.041>big, <00:22:35.149>uh, <00:22:35.257>big <00:22:35.365>win.

493
00:22:38.195 --> 00:22:39.975
<00:22:38.195>And <00:22:38.475>it <00:22:38.754>also <00:22:39.034>created <00:22:39.314>nice <00:22:39.595>queries

494
00:22:40.115 --> 00:22:42.055
<00:22:40.115>and <00:22:40.348>the <00:22:40.581>queries, <00:22:40.815>they're <00:22:41.048>like <00:22:41.281>totally <00:22:41.515>correct.

495
00:22:42.515 --> 00:22:44.975
<00:22:42.515>So <00:22:42.655>what <00:22:42.795>this <00:22:42.935>one <00:22:43.075>is <00:22:43.215>doing <00:22:43.355>here <00:22:43.495>is <00:22:43.635>it's <00:22:43.775>using <00:22:43.915>the,

496
00:22:45.155 --> 00:22:48.415
<00:22:45.155>an <00:22:45.355>intrinsic <00:22:45.555>graph <00:22:45.754>function, <00:22:45.955>taking <00:22:46.155>a <00:22:46.355>graph, <00:22:46.555>um,

497
00:22:48.565 --> 00:22:51.895
<00:22:48.565>that <00:22:48.692>is <00:22:48.819>just <00:22:48.946>created <00:22:49.074>and <00:22:49.201>it's <00:22:49.328>doing <00:22:49.455>a <00:22:49.583>graph <00:22:49.710>match <00:22:49.837>from <00:22:49.965>user

498
00:22:52.085 --> 00:22:53.455
<00:22:52.085>authenticates <00:22:52.701>to <00:22:53.318>host.

499
00:22:53.995 --> 00:22:57.175
<00:22:53.995>Uh, <00:22:54.150>it <00:22:54.306>adds <00:22:54.461>a <00:22:54.617>couple <00:22:54.772>of <00:22:54.928>constraints <00:22:55.083>for <00:22:55.239>specific <00:22:55.395>labels

500
00:22:57.175 --> 00:23:00.975
<00:22:57.175>that <00:22:57.350>it <00:22:57.524>created <00:22:57.700>in <00:22:57.875>a <00:22:58.050>specific, <00:22:58.225>um, <00:22:58.399>authentication <00:22:58.575>property,

501
00:23:01.325 --> 00:23:03.175
<00:23:01.325>projected <00:23:01.791>out <00:23:02.258>specific, <00:23:02.725>um,

502
00:23:03.265 --> 00:23:04.935
<00:23:03.265>users <00:23:03.498>host <00:23:03.731>them <00:23:03.965>and <00:23:04.198>source <00:23:04.431>site <00:23:04.665>piece.

503
00:23:05.315 --> 00:23:07.975
<00:23:05.315>And <00:23:05.515>then <00:23:05.715>created <00:23:05.915>a <00:23:06.115>breakdown <00:23:06.315>using <00:23:06.515>the <00:23:06.715>summarize

504
00:23:08.515 --> 00:23:10.615
<00:23:08.515>and <00:23:08.715>only <00:23:08.915>selected <00:23:09.115>the <00:23:09.315>ones <00:23:09.515>that <00:23:09.715>are <00:23:09.915>interesting

505
00:23:12.075 --> 00:23:15.415
<00:23:12.075>and <00:23:12.202>all <00:23:12.329>of <00:23:12.456>that, <00:23:12.584>let's <00:23:12.711>say <00:23:12.838>in <00:23:12.965>within <00:23:13.093>a <00:23:13.220>couple <00:23:13.347>of <00:23:13.475>minutes.

506
00:23:15.635 --> 00:23:17.535
<00:23:15.635>And <00:23:15.835>I <00:23:16.035>didn't <00:23:16.235>have <00:23:16.435>to <00:23:16.635>invest, <00:23:16.835>uh, <00:23:17.035>hours

507
00:23:17.675 --> 00:23:18.775
<00:23:17.675>to, <00:23:17.873>to <00:23:18.071>get <00:23:18.269>to <00:23:18.467>that <00:23:18.665>point.

508
00:23:19.675 --> 00:23:21.335
<00:23:19.675>And <00:23:19.815>then, <00:23:19.955>you <00:23:20.095>know, <00:23:20.235>I <00:23:20.375>took <00:23:20.514>it <00:23:20.655>a <00:23:20.794>bit <00:23:20.935>too <00:23:21.075>far,

509
00:23:21.875 --> 00:23:23.735
<00:23:21.875>uh, <00:23:22.225>want <00:23:22.575>to <00:23:22.925>be <00:23:23.275>honest.

510
00:23:23.835 --> 00:23:26.175
<00:23:23.835>So <00:23:24.035>I <00:23:24.235>said, <00:23:24.435>okay, <00:23:24.635>generate <00:23:24.835>an <00:23:25.035>HDML <00:23:25.235>report

511
00:23:26.175 --> 00:23:29.415
<00:23:26.175>with <00:23:26.408>some <00:23:26.641>interactive <00:23:26.875>D <00:23:27.108>three <00:23:27.341>visualization, <00:23:27.575>visualization,

512
00:23:30.155 --> 00:23:32.335
<00:23:30.155>um, <00:23:30.388>and, <00:23:30.621>you <00:23:30.855>know, <00:23:31.088>just <00:23:31.321>do <00:23:31.555>it.

513
00:23:32.835 --> 00:23:34.175
<00:23:32.835>You <00:23:33.036>see <00:23:33.237>it, <00:23:33.438>it <00:23:33.639>struggled <00:23:33.840>a <00:23:34.041>bit,

514
00:23:34.195 --> 00:23:37.335
<00:23:34.195>but <00:23:34.370>it <00:23:34.544>also <00:23:34.720>learned <00:23:34.895>by <00:23:35.070>asking <00:23:35.245>for, <00:23:35.419>for <00:23:35.595>hints

515
00:23:37.335 --> 00:23:39.895
<00:23:37.335>and <00:23:37.568>asking <00:23:37.801>for, <00:23:38.035>um, <00:23:38.268>for <00:23:38.501>best <00:23:38.735>practices.

516
00:23:39.895 --> 00:23:41.135
<00:23:39.895>So <00:23:40.118>it <00:23:40.341>was <00:23:40.564>learning <00:23:40.787>over <00:23:41.011>time.

517
00:23:41.515 --> 00:23:43.695
<00:23:41.515>You <00:23:41.670>see <00:23:41.826>all <00:23:41.981>of <00:23:42.137>these <00:23:42.292>mistakes, <00:23:42.448>you <00:23:42.603>know, <00:23:42.759>if, <00:23:42.915>if

518
00:23:43.695 --> 00:23:44.975
<00:23:43.695>that <00:23:43.925>would've <00:23:44.155>happened <00:23:44.386>in <00:23:44.616>this <00:23:44.847>demo

519
00:23:45.105 --> 00:23:46.525
<00:23:45.105>and <00:23:45.287>I <00:23:45.470>see <00:23:45.652>all <00:23:45.835>of <00:23:46.017>these <00:23:46.200>red <00:23:46.383>crosses,

520
00:23:46.565 --> 00:23:48.045
<00:23:46.565>I <00:23:46.831>would've <00:23:47.097>been <00:23:47.364>sweating <00:23:47.630>like <00:23:47.897>crazy.

521
00:23:48.585 --> 00:23:51.085
<00:23:48.585>So <00:23:48.818>I <00:23:49.051>decided, <00:23:49.285>let's <00:23:49.518>take <00:23:49.751>a <00:23:49.985>screenshot.

522
00:23:51.585 --> 00:23:53.685
<00:23:51.585>Um, <00:23:52.051>it's <00:23:52.518>much <00:23:52.985>easier.

523
00:23:54.895 --> 00:23:56.915
<00:23:54.895>And <00:23:55.128>then <00:23:55.361>it <00:23:55.595>created <00:23:55.828>a <00:23:56.061>beautiful <00:23:56.295>website.

524
00:23:57.455 --> 00:23:58.595
<00:23:57.455>Uh, <00:23:57.797>I <00:23:58.139>mean <00:23:58.481>simple,

525
00:23:58.695 --> 00:24:00.995
<00:23:58.695>but <00:23:58.835>you <00:23:58.975>know, <00:23:59.115>for <00:23:59.254>something <00:23:59.395>that <00:23:59.534>happens <00:23:59.675>in, <00:23:59.814>within <00:23:59.955>a <00:24:00.095>couple

526
00:24:00.995 --> 00:24:03.875
<00:24:00.995>of <00:24:01.169>minutes, <00:24:01.344>just <00:24:01.520>for <00:24:01.695>me <00:24:01.870>to <00:24:02.044>get <00:24:02.219>an <00:24:02.395>understanding

527
00:24:03.875 --> 00:24:05.035
<00:24:03.875>of <00:24:04.136>what's <00:24:04.397>happening <00:24:04.658>for <00:24:04.919>me,

528
00:24:05.035 --> 00:24:06.875
<00:24:05.035>that's <00:24:05.315>super <00:24:05.595>productive <00:24:05.875>and <00:24:06.155>super <00:24:06.435>helpful.

529
00:24:07.815 --> 00:24:09.435
<00:24:07.815>It <00:24:08.048>also <00:24:08.281>created <00:24:08.515>a <00:24:08.748>D <00:24:08.981>three <00:24:09.215>graph.

530
00:24:09.495 --> 00:24:12.435
<00:24:09.495>You <00:24:09.622>know, <00:24:09.749>I, <00:24:09.876>I <00:24:10.004>took <00:24:10.131>a <00:24:10.258>nice <00:24:10.385>screenshot <00:24:10.513>when <00:24:10.640>it <00:24:10.767>was <00:24:10.895>working

531
00:24:12.595 --> 00:24:16.115
<00:24:12.595>okay-ish, <00:24:12.828>but <00:24:13.061>it, <00:24:13.295>you <00:24:13.528>know, <00:24:13.761>let's <00:24:13.995>say

532
00:24:17.185 --> 00:24:18.315
<00:24:17.185>it's, <00:24:17.439>uh, <00:24:17.693>it's <00:24:17.947>a <00:24:18.202>start.

533
00:24:19.295 --> 00:24:23.115
<00:24:19.295>Um, <00:24:19.422>but, <00:24:19.549>and <00:24:19.676>this <00:24:19.804>is <00:24:19.931>probably <00:24:20.058>also <00:24:20.185>a <00:24:20.313>bit <00:24:20.440>too <00:24:20.567>bold, <00:24:20.695>okay?

534
00:24:23.255 --> 00:24:25.675
<00:24:23.255>So <00:24:23.535>it's, <00:24:23.815>uh, <00:24:24.095>it's <00:24:24.375>probably <00:24:24.655>something

535
00:24:25.675 --> 00:24:26.955
<00:24:25.675>that's <00:24:25.905>not <00:24:26.135>a <00:24:26.366>hundred <00:24:26.596>percent <00:24:26.827>correct.

536
00:24:27.495 --> 00:24:29.155
<00:24:27.495>So <00:24:27.728>from <00:24:27.961>six <00:24:28.195>hours <00:24:28.428>to <00:24:28.661>six <00:24:28.895>minutes,

537
00:24:30.435 --> 00:24:31.485
<00:24:30.435>it's <00:24:30.624>probably <00:24:30.812>a <00:24:31.002>bit <00:24:31.190>too <00:24:31.379>much.

538
00:24:31.505 --> 00:24:32.765
<00:24:31.505>But <00:24:31.694>you <00:24:31.883>know, <00:24:32.072>for <00:24:32.261>me <00:24:32.450>it's <00:24:32.639>a,

539
00:24:33.195 --> 00:24:35.605
<00:24:33.195>it's <00:24:33.475>really <00:24:33.754>fundamentally <00:24:34.034>a <00:24:34.314>large <00:24:34.595>help.

540
00:24:36.305 --> 00:24:38.325
<00:24:36.305>At <00:24:36.460>least <00:24:36.616>I, <00:24:36.771>I <00:24:36.927>would <00:24:37.082>like <00:24:37.238>to <00:24:37.393>clone <00:24:37.549>myself <00:24:37.705>now,

541
00:24:38.325 --> 00:24:39.685
<00:24:38.325>create <00:24:38.631>an <00:24:38.937>agent <00:24:39.243>of <00:24:39.549>myself,

542
00:24:39.705 --> 00:24:41.445
<00:24:39.705>and <00:24:39.938>if <00:24:40.171>somebody <00:24:40.405>else <00:24:40.638>me, <00:24:40.871>Hey <00:24:41.105>honey,

543
00:24:41.505 --> 00:24:42.885
<00:24:41.505>can <00:24:41.712>you <00:24:41.919>help <00:24:42.126>me <00:24:42.333>with <00:24:42.540>that <00:24:42.747>model?

544
00:24:43.725 --> 00:24:46.565
<00:24:43.725>I <00:24:43.852>would <00:24:43.979>be <00:24:44.106>totally <00:24:44.234>happy <00:24:44.361>if <00:24:44.488>the <00:24:44.615>agent <00:24:44.743>is <00:24:44.870>taking <00:24:44.997>like <00:24:45.125>95

545
00:24:46.585 --> 00:24:48.965
<00:24:46.585>of <00:24:46.785>the <00:24:46.985>95% <00:24:47.185>of <00:24:47.385>the, <00:24:47.585>of <00:24:47.785>the <00:24:47.985>requests,

546
00:24:49.965 --> 00:24:52.345
<00:24:49.965>but <00:24:50.165>there's <00:24:50.365>also <00:24:50.564>something, <00:24:50.764>something <00:24:50.965>true <00:24:51.165>about <00:24:51.365>this.

547
00:24:53.965 --> 00:24:58.065
<00:24:53.965>Um, <00:24:54.198>okay, <00:24:54.431>so <00:24:54.665>a <00:24:54.898>couple <00:24:55.131>of <00:24:55.365>news.

548
00:24:58.565 --> 00:25:02.185
<00:24:58.565>Um, <00:24:58.720>so <00:24:58.876>by <00:24:59.031>the <00:24:59.187>way, <00:24:59.342>feel <00:24:59.498>free <00:24:59.653>to <00:24:59.809>ask <00:24:59.965>questions.

549
00:25:02.265 --> 00:25:04.265
<00:25:02.265>I <00:25:02.420>think <00:25:02.576>you <00:25:02.731>have <00:25:02.887>this <00:25:03.042>app. <00:25:03.198>I'm <00:25:03.353>happy <00:25:03.509>to <00:25:03.665>answer,

550
00:25:04.265 --> 00:25:06.225
<00:25:04.265>but <00:25:04.465>you <00:25:04.665>can <00:25:04.865>also <00:25:05.065>answer <00:25:05.265>questions <00:25:05.465>after <00:25:05.665>this.

551
00:25:06.805 --> 00:25:11.305
<00:25:06.805>Uh, <00:25:06.980>anybody <00:25:07.155>knows <00:25:07.330>Graph <00:25:07.505>history <00:25:07.680>in <00:25:07.855>this, <00:25:08.030>uh, <00:25:08.205>forum

552
00:25:12.305 --> 00:25:15.185
<00:25:12.305>graph <00:25:12.505>history, <00:25:12.705>it's <00:25:12.905>an <00:25:13.105>open <00:25:13.305>source <00:25:13.505>Python <00:25:13.705>library.

553
00:25:15.685 --> 00:25:18.505
<00:25:15.685>It <00:25:15.918>is <00:25:16.151>using <00:25:16.385>GPUs <00:25:16.618>to <00:25:16.851>render <00:25:17.085>graphs.

554
00:25:18.995 --> 00:25:21.985
<00:25:18.995>Right <00:25:19.111>now, <00:25:19.228>if <00:25:19.344>you, <00:25:19.461>if <00:25:19.578>you <00:25:19.695>have <00:25:19.811>like <00:25:19.928>a, <00:25:20.044>just <00:25:20.161>a <00:25:20.278>simple <00:25:20.395>web,

555
00:25:22.165 --> 00:25:24.105
<00:25:22.165>uh, <00:25:22.320>web <00:25:22.476>front <00:25:22.631>end <00:25:22.787>and <00:25:22.942>you <00:25:23.098>want <00:25:23.253>to <00:25:23.409>render <00:25:23.565>graphs,

556
00:25:24.525 --> 00:25:26.905
<00:25:24.525>you <00:25:24.725>might <00:25:24.925>struggle <00:25:25.125>with, <00:25:25.325>I <00:25:25.525>don't <00:25:25.725>know, <00:25:25.925>10,000

557
00:25:26.965 --> 00:25:30.065
<00:25:26.965>or <00:25:27.165>50,000 <00:25:27.365>edges <00:25:27.564>after <00:25:27.764>that, <00:25:27.965>forget <00:25:28.165>about <00:25:28.365>it.

558
00:25:30.255 --> 00:25:33.425
<00:25:30.255>Your <00:25:30.430>browser <00:25:30.605>will <00:25:30.780>just <00:25:30.955>die <00:25:31.130>byebye <00:25:31.305>see <00:25:31.480>you, <00:25:31.655>uh,

559
00:25:33.665 --> 00:25:37.345
<00:25:33.665>graph <00:25:33.805>history <00:25:33.945>is <00:25:34.085>doing <00:25:34.225>the <00:25:34.365>actual <00:25:34.504>hard <00:25:34.645>work <00:25:34.784>on <00:25:34.925>the <00:25:35.065>GPU

560
00:25:37.365 --> 00:25:40.425
<00:25:37.365>and <00:25:37.505>they <00:25:37.645>have <00:25:37.785>a <00:25:37.925>dedicated <00:25:38.065>GPU <00:25:38.205>in <00:25:38.345>a <00:25:38.485>specific <00:25:38.625>virtual <00:25:38.765>machine,

561
00:25:40.445 --> 00:25:43.785
<00:25:40.445>and <00:25:40.600>you're <00:25:40.756>just <00:25:40.911>getting <00:25:41.067>the <00:25:41.222>data <00:25:41.378>from <00:25:41.533>that, <00:25:41.689>uh, <00:25:41.845>from

562
00:25:43.785 --> 00:25:47.545
<00:25:43.785>that <00:25:43.925>GPU <00:25:44.065>in <00:25:44.205>instead <00:25:44.345>of <00:25:44.485>rendering <00:25:44.625>it <00:25:44.765>in <00:25:44.905>a <00:25:45.045>browser <00:25:45.185>yourself.

563
00:25:48.045 --> 00:25:49.625
<00:25:48.045>And <00:25:48.278>just <00:25:48.511>this <00:25:48.745>week <00:25:48.978>we <00:25:49.211>released <00:25:49.445>a,

564
00:25:49.625 --> 00:25:51.225
<00:25:49.625>they <00:25:49.905>released <00:25:50.185>a <00:25:50.465>connector <00:25:50.745>to <00:25:51.025>Custo.

565
00:25:51.685 --> 00:25:54.225
<00:25:51.685>Uh, <00:25:51.885>so <00:25:52.085>now <00:25:52.284>we <00:25:52.485>can <00:25:52.685>actually <00:25:52.885>render <00:25:53.085>millions

566
00:25:54.225 --> 00:25:56.225
<00:25:54.225>and <00:25:54.504>millions <00:25:54.784>of <00:25:55.064>nodes <00:25:55.344>from <00:25:55.625>graphs

567
00:25:56.225 --> 00:25:59.265
<00:25:56.225>that <00:25:56.365>are <00:25:56.504>sitting <00:25:56.645>in <00:25:56.784>this <00:25:56.925>big <00:25:57.064>database <00:25:57.205>that <00:25:57.344>you <00:25:57.485>have <00:25:57.625>seen,

568
00:25:59.365 --> 00:26:00.545
<00:25:59.365>uh, <00:25:59.577>that <00:25:59.789>you <00:26:00.002>have <00:26:00.214>seen <00:26:00.427>before.

569
00:26:00.935 --> 00:26:02.945
<00:26:00.935>It's <00:26:01.135>very <00:26:01.335>powerful. <00:26:01.534>And <00:26:01.735>on <00:26:01.935>top <00:26:02.135>of <00:26:02.335>that,

570
00:26:02.945 --> 00:26:04.945
<00:26:02.945>they <00:26:03.145>also <00:26:03.345>have <00:26:03.544>something <00:26:03.745>that's <00:26:03.945>called <00:26:04.145>louy <00:26:04.345>ai.

571
00:26:05.545 --> 00:26:09.185
<00:26:05.545>I <00:26:05.672>can <00:26:05.799>recommend <00:26:05.926>that <00:26:06.054>to <00:26:06.181>anybody <00:26:06.308>if <00:26:06.435>you <00:26:06.563>just <00:26:06.690>search <00:26:06.817>for <00:26:06.945>both

572
00:26:09.185 --> 00:26:11.225
<00:26:09.185>of <00:26:09.465>the <00:26:09.745>SOC <00:26:10.024>and <00:26:10.304>louy <00:26:10.585>ai.

573
00:26:11.225 --> 00:26:14.265
<00:26:11.225>That's, <00:26:11.399>uh, <00:26:11.574>that <00:26:11.750>stuff <00:26:11.925>is <00:26:12.100>just <00:26:12.274>mind <00:26:12.449>blowing. <00:26:12.625>Okay?

574
00:26:14.325 --> 00:26:16.385
<00:26:14.325>All <00:26:14.480>of <00:26:14.636>this <00:26:14.791>stuff <00:26:14.947>that <00:26:15.102>I've <00:26:15.258>shown <00:26:15.413>is <00:26:15.569>just <00:26:15.725>kindergarten,

575
00:26:16.785 --> 00:26:18.705
<00:26:16.785>probably <00:26:16.925>also <00:26:17.065>many <00:26:17.205>of <00:26:17.345>the <00:26:17.485>other <00:26:17.625>things <00:26:17.765>that <00:26:17.905>you <00:26:18.045>have <00:26:18.185>seen.

576
00:26:19.235 --> 00:26:20.905
<00:26:19.235>Check <00:26:19.514>out <00:26:19.794>LU <00:26:20.074>AI <00:26:20.354>with <00:26:20.635>graphs

577
00:26:20.965 --> 00:26:24.175
<00:26:20.965>and <00:26:21.105>what <00:26:21.245>you <00:26:21.385>can <00:26:21.524>do <00:26:21.665>with <00:26:21.804>both <00:26:21.945>of <00:26:22.084>the, <00:26:22.225>so, <00:26:22.365>um,

578
00:26:24.325 --> 00:26:25.495
<00:26:24.325>call <00:26:24.535>to <00:26:24.746>action <00:26:24.956>for <00:26:25.167>you <00:26:25.378>guys.

579
00:26:25.555 --> 00:26:28.495
<00:26:25.555>For <00:26:25.730>those <00:26:25.905>who <00:26:26.080>don't <00:26:26.255>know <00:26:26.430>KQL, <00:26:26.605>it's, <00:26:26.780>you <00:26:26.955>know,

580
00:26:28.495 --> 00:26:31.055
<00:26:28.495>it's <00:26:28.774>fundamental <00:26:29.054>that <00:26:29.334>Microsoft <00:26:29.614>to, <00:26:29.895>um,

581
00:26:32.315 --> 00:26:34.375
<00:26:32.315>to <00:26:32.490>have <00:26:32.665>at <00:26:32.840>least <00:26:33.015>some <00:26:33.190>knowledge, <00:26:33.365>uh, <00:26:33.540>about <00:26:33.715>it.

582
00:26:34.495 --> 00:26:37.255
<00:26:34.495>I <00:26:34.695>would <00:26:34.895>say, <00:26:35.094>uh, <00:26:35.294>because <00:26:35.495>it's, <00:26:35.695>it's <00:26:35.895>everywhere.

583
00:26:37.285 --> 00:26:38.895
<00:26:37.285>There's <00:26:37.635>no <00:26:37.985>number <00:26:38.335>at <00:26:38.685>Microsoft,

584
00:26:38.895 --> 00:26:41.655
<00:26:38.895>which <00:26:39.050>is <00:26:39.206>not <00:26:39.361>have <00:26:39.517>been <00:26:39.672>produced <00:26:39.828>by <00:26:39.983>some <00:26:40.139>KQL <00:26:40.295>query.

585
00:26:41.885 --> 00:26:42.975
<00:26:41.885>It's <00:26:42.375>really <00:26:42.866>everywhere.

586
00:26:43.545 --> 00:26:45.205
<00:26:43.545>So <00:26:43.825>call <00:26:44.105>to <00:26:44.385>action <00:26:44.665>is <00:26:44.945>go

587
00:26:45.205 --> 00:26:47.965
<00:26:45.205>and <00:26:45.345>get <00:26:45.485>a <00:26:45.625>free <00:26:45.764>cluster <00:26:45.905>with <00:26:46.044>free <00:26:46.185>cluster, <00:26:46.324>I <00:26:46.465>mean <00:26:46.605>free.

588
00:26:48.105 --> 00:26:50.085
<00:26:48.105>You <00:26:48.245>don't <00:26:48.385>need <00:26:48.525>to <00:26:48.665>have <00:26:48.805>a <00:26:48.945>credit <00:26:49.085>card, <00:26:49.225>you <00:26:49.365>don't <00:26:49.505>need

589
00:26:50.085 --> 00:26:51.125
<00:26:50.085>to <00:26:50.397>have <00:26:50.709>a <00:26:51.021>subscription.

590
00:26:51.425 --> 00:26:53.925
<00:26:51.425>You <00:26:51.552>just <00:26:51.679>go <00:26:51.806>to <00:26:51.934>this <00:26:52.061>URL <00:26:52.188>and <00:26:52.315>you <00:26:52.443>get <00:26:52.570>a <00:26:52.697>free <00:26:52.825>cluster.

591
00:26:54.265 --> 00:26:56.805
<00:26:54.265>And <00:26:54.372>all <00:26:54.480>of <00:26:54.588>my <00:26:54.695>demos <00:26:54.803>that <00:26:54.911>I <00:26:55.018>did, <00:26:55.126>were <00:26:55.234>all <00:26:55.341>on <00:26:55.449>the <00:26:55.557>free <00:26:55.665>cluster

592
00:26:57.105 --> 00:26:59.525
<00:26:57.105>and <00:26:57.260>I'm <00:26:57.416>doing <00:26:57.571>my <00:26:57.727>entire <00:26:57.882>home <00:26:58.038>automation <00:26:58.193>on <00:26:58.349>that <00:26:58.505>cluster.

593
00:26:59.625 --> 00:27:02.645
<00:26:59.625>So <00:26:59.800>it's <00:26:59.975>really <00:27:00.150>very, <00:27:00.325>very, <00:27:00.500>like, <00:27:00.675>it's <00:27:00.850>very <00:27:01.025>good.

594
00:27:03.665 --> 00:27:06.485
<00:27:03.665>Um, <00:27:03.840>create <00:27:04.014>your <00:27:04.190>first <00:27:04.365>graph, <00:27:04.540>have <00:27:04.715>nice <00:27:04.889>demo, <00:27:05.065>uh,

595
00:27:06.515 --> 00:27:07.965
<00:27:06.515>nice <00:27:06.950>documentation <00:27:07.385>for <00:27:07.820>you.

596
00:27:08.355 --> 00:27:09.925
<00:27:08.355>Take <00:27:08.555>a <00:27:08.755>look <00:27:08.955>at <00:27:09.155>the <00:27:09.355>graph <00:27:09.555>history <00:27:09.755>demo

597
00:27:10.505 --> 00:27:12.685
<00:27:10.505>and <00:27:10.705>uh, <00:27:10.905>yeah, <00:27:11.105>rescue <00:27:11.305>Pro, <00:27:11.505>smoke <00:27:11.705>from <00:27:11.905>crypto.

598
00:27:13.225 --> 00:27:15.805
<00:27:13.225>So <00:27:13.352>crypto <00:27:13.479>was <00:27:13.606>the <00:27:13.734>bad <00:27:13.861>guy <00:27:13.988>in <00:27:14.115>the <00:27:14.243>second <00:27:14.370>season. <00:27:14.497>A <00:27:14.625>little.

599
00:27:16.585 --> 00:27:19.205
<00:27:16.585>Um, <00:27:16.865>yeah, <00:27:17.145>it <00:27:17.425>was <00:27:17.705>also <00:27:17.985>funny.

600
00:27:19.585 --> 00:27:22.685
<00:27:19.585>And <00:27:19.701>you <00:27:19.818>can <00:27:19.935>play <00:27:20.051>all <00:27:20.168>of <00:27:20.285>these <00:27:20.401>old <00:27:20.518>seasons <00:27:20.635>if <00:27:20.751>you <00:27:20.868>don't <00:27:20.985>want

601
00:27:22.685 --> 00:27:25.405
<00:27:22.685>to <00:27:22.860>go <00:27:23.034>through, <00:27:23.210>I <00:27:23.385>dunno, <00:27:23.560>tens, <00:27:23.735>uh, <00:27:23.909>of <00:27:24.085>doc

602
00:27:25.425 --> 00:27:26.485
<00:27:25.425>of <00:27:25.902>documentation <00:27:26.379>pages

603
00:27:26.545 --> 00:27:28.245
<00:27:26.545>or <00:27:26.825>even <00:27:27.105>hundreds <00:27:27.385>of <00:27:27.665>documentation <00:27:27.945>pages.