Upon digging around Microsoft’s documentation for user-defined functions I stumbled on the function pair_probabilities_fl(). This function calculates probabilities and some additional metrics for a pair of categorical variables, A and B. In this blog post, we are exploring the possibility of using the pair probabilities function for threat hunting. The documentation explains the output metrics in detail, but I am going to briefly go through the key points to help provide some context for the rest of the blog.