.module-content[data-course="threat-hunting-m365"]{--dx-bg:#1c1f26;--dx-panel:#20242b;--dx-raise:#2d313a;--dx-line:#383d47;--dx-line2:#424854;--dx-text:#e3e5e8;--dx-dim:#8f96a3;--dx-faint:#7a818e;--dx-code:#1a1d23;--dx-cyan:#e86a2a;--dx-cyan-bg:rgba(232,106,42,.10);--dx-red:#f87171;--dx-red-bg:rgba(248,113,113,.10);--dx-amber:#fbbf24;--dx-amber-bg:rgba(251,191,36,.10);--dx-green:#4ade80;--dx-green-bg:rgba(74,222,128,.10);--dx-mono:'JetBrains Mono','Fira Code',ui-monospace,monospace}[data-course="threat-hunting-m365"] .module-quicklinks{background:#20242b;border:1px solid #383d47}[data-course="threat-hunting-m365"] .module-quicklinks .mql-label{color:#8f96a3}[data-course="threat-hunting-m365"] .module-quicklinks .mql-item{background:#20242b;color:#8f96a3 !important}[data-course="threat-hunting-m365"] .module-quicklinks .mql-item:hover{background:#2d313a}[data-course="threat-hunting-m365"] .module-quicklinks .mql-item.current{background:#e86a2a;color:#23272e !important;border-color:#e86a2a}[data-course="threat-hunting-m365"] .rc-section{background:#20242b;border-left:4px solid #e86a2a}[data-course="threat-hunting-m365"] .rc-section-n{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-section .rc-section-t,.module-content[data-course="threat-hunting-m365"] .rc-section .rc-section-t{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-section-sub{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-section.is-done .rc-section-sub{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-section-tick{border:1.5px solid rgba(143,150,163,0.38)}[data-course="threat-hunting-m365"] .rc-section-tick:hover{border-color:#4ade80}[data-course="threat-hunting-m365"] .rc-section.is-done .rc-section-tick{background:rgba(74,222,128,.12);border-color:#4ade80}[data-course="threat-hunting-m365"] .rc-section.is-done .rc-section-tick::after{border-right:2px solid #383d47;border-bottom:2px solid #383d47}[data-course="threat-hunting-m365"] .rc-section.is-done .rc-section-t{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-section-mark{color:#4ade80;border:1px solid rgba(74,222,128,.12)}[data-course="threat-hunting-m365"] .rc-section-chev{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-section.is-do{background:#0f2418}[data-course="threat-hunting-m365"] .rc-map-title{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-map-count{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-map-row{background:#20242b}[data-course="threat-hunting-m365"] .rc-map-row:hover{border-left-color:#e86a2a}[data-course="threat-hunting-m365"] .rc-map-n{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-map-dot{border:1.5px solid rgba(143,150,163,0.34)}[data-course="threat-hunting-m365"] .rc-map-row.is-done .rc-map-dot{background:rgba(74,222,128,.12);border-color:#4ade80}[data-course="threat-hunting-m365"] .rc-map-row.is-done .rc-map-label{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-map-label{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-map-desc{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-map-row.is-done .rc-map-desc{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-map-kind{color:#e3e5e8;border:1px solid rgba(143,150,163,0.18)}[data-course="threat-hunting-m365"] .rc-map-row.is-drill{background:#0f2418}[data-course="threat-hunting-m365"] .rc-map-row.is-drill .rc-map-kind{color:#4ade80;border-color:rgba(74,222,128,.12)}[data-course="threat-hunting-m365"] .rc-map-row.is-close{background:#20242b}[data-course="threat-hunting-m365"] .rc-action{background:#20242b}[data-course="threat-hunting-m365"] .rc-action-head{border-bottom:1px solid rgba(143,150,163,0.10)}[data-course="threat-hunting-m365"] .rc-action-tag{color:#23272e;background:#e86a2a}[data-course="threat-hunting-m365"] .rc-action-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-action-body > p{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-action-steps li{border-bottom:1px solid rgba(143,150,163,0.07);color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-action-steps li::before{background:rgba(232,106,42,.12);border:1px solid #e86a2a;color:#e86a2a}[data-course="threat-hunting-m365"] .rc-action-steps code{background:rgba(227,229,232,0.12);color:#e86a2a}[data-course="threat-hunting-m365"] .rc-action-out{background:rgba(232,106,42,.12);border-left:3px solid #e86a2a;color:#e86a2a}[data-course="threat-hunting-m365"] .rc-action-out strong{color:#e3e5e8}[data-course="threat-hunting-m365"] .tok-keyword{color:#f5a572}[data-course="threat-hunting-m365"] .tok-operator{color:#f5a572}[data-course="threat-hunting-m365"] .tok-function{color:#4ade80}[data-course="threat-hunting-m365"] .tok-string{color:#4ade80}[data-course="threat-hunting-m365"] .tok-number{color:#fbbf24}[data-course="threat-hunting-m365"] .tok-timespan{color:#fbbf24}[data-course="threat-hunting-m365"] .tok-pipe{color:#e3e5e8}[data-course="threat-hunting-m365"] .tok-comment{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-dir{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-leaf{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .ps-cmdlet{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .ps-param{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .ps-str{color:#4ade80}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .ps-var{color:#f87171}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .ps-prompt{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .ps-comment,[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-comment{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-cmd{color:#e3e5e8}[data-course="threat-hunting-m365"] .tok-var{color:#f87171}[data-course="threat-hunting-m365"] .tok-ident{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-aid{border:1px solid #383d47;background:#20242b}[data-course="threat-hunting-m365"] .rc-aid-head{border-bottom:1px solid #383d47;color:#8f96a3}[data-course="threat-hunting-m365"] .rc-aid-head b{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-aid-btn{background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-aid-btn:focus-visible,[data-course="threat-hunting-m365"] .rc-aid button:focus-visible,[data-course="threat-hunting-m365"] .rc-aid input:focus-visible,[data-course="threat-hunting-m365"] .rc-aid textarea:focus-visible{outline:2px solid #e86a2a}[data-course="threat-hunting-m365"] .rc-aid-verdict{color:#e3e5e8;border-left:3px solid #383d47}[data-course="threat-hunting-m365"] .rc-aid-verdict.is-ok{border-color:#4ade80}[data-course="threat-hunting-m365"] .rc-aid-verdict.is-no{border-color:#f87171}[data-course="threat-hunting-m365"] .rc-predict-out .rc-code{border-top:1px dashed #424854}[data-course="threat-hunting-m365"] .rc-spot-line::before{background:#e86a2a}[data-course="threat-hunting-m365"] .rc-spot-line:hover{background:rgba(232,106,42,.12)}[data-course="threat-hunting-m365"] .rc-spot-line.is-hit{border-left-color:#4ade80;background:rgba(74,222,128,.12)}[data-course="threat-hunting-m365"] .rc-spot-line.is-hit::before{background:#4ade80}[data-course="threat-hunting-m365"] .rc-spot-line.is-miss{border-left-color:#f87171;background:rgba(248,113,113,.12)}[data-course="threat-hunting-m365"] .rc-aid-verdict.is-warn{border-color:#e86a2a}[data-course="threat-hunting-m365"] .rc-testrun-line{color:#8f96a3;background:#2d313a}[data-course="threat-hunting-m365"] .kqlcs{border:1px solid #383d47;background:#20242b}[data-course="threat-hunting-m365"] .kqlcs-head{background:#20242b;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .kqlcs-kind{color:#e3e5e8;background:#20242b}[data-course="threat-hunting-m365"] .kqlcs-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .kqlcs-score{color:#8f96a3}[data-course="threat-hunting-m365"] .kqlcs-score.is-done{color:#8f96a3}.module-content[data-course="threat-hunting-m365"] p.kqlcs-intro{color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .kqlcs-ws .kqlcs-tables{color:#8f96a3}[data-course="threat-hunting-m365"] .kqlcs-editor{border:1px solid #424854;background:#20242b;color:#e3e5e8;caret-color:#e86a2a}[data-course="threat-hunting-m365"] .kqlcs-editor:focus{border-color:#e86a2a}[data-course="threat-hunting-m365"] .kqlcs-editor::placeholder{color:#8f96a3}[data-course="threat-hunting-m365"] .kqlcs-q{border:1px solid #383d47;background:#20242b}[data-course="threat-hunting-m365"] .kqlcs-q.is-ok{border-color:#383d47;background:#20242b}.module-content[data-course="threat-hunting-m365"] p.kqlcs-prompt{color:#e3e5e8}[data-course="threat-hunting-m365"] .kqlcs-answer{border:1px solid #383d47;background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .kqlcs-answer:focus{border-color:#e86a2a}[data-course="threat-hunting-m365"] .kqlcs-check{background:#e86a2a;color:#23272e}[data-course="threat-hunting-m365"] .kqlcs-check:disabled{background:#0f2418}[data-course="threat-hunting-m365"] .kqlcs-ok{color:#8f96a3}[data-course="threat-hunting-m365"] .kqlcs-no{color:#8f96a3}[data-course="threat-hunting-m365"] .kqlcs.is-compact .kqlcs-kind{background:#e86a2a}.module-content[data-course="threat-hunting-m365"] p.kqlcs-own{color:#8f96a3;background:#2d313a;border-left:3px solid #e86a2a}[data-course="threat-hunting-m365"] .rc-vd-pane:has(> .rc-code[data-lang="output"]),[data-course="threat-hunting-m365"] .rc-vd-pane:has(.rc-code-bare > .rc-code[data-lang="output"]){background:#20242b;border-color:#383d47;border-top-color:#f87171}[data-course="threat-hunting-m365"] .rc-vd-pane:has(.rc-code[data-lang="output"]) .rc-vd-head{background:#2d313a;border-bottom-color:#383d47;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-vd-pane:has(.rc-code[data-lang="output"]) .rc-vd-out{background:#20242b;border-top-color:#383d47;color:#8f96a3}[data-course="threat-hunting-m365"] .rc-vd-pane:has(.rc-code[data-lang="output"]) .rc-vd-k{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-vd-pane.is-right:has(.rc-code[data-lang="output"]){border-top-color:#4ade80}[data-course="threat-hunting-m365"] .rc-vd-pane.is-wrong:has(.rc-code[data-lang="output"]) .rc-vd-v{color:#f87171}[data-course="threat-hunting-m365"] .rc-vd-pane.is-right:has(.rc-code[data-lang="output"]) .rc-vd-v{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-aid-body{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code{background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code[data-bare]:not([data-lang]){background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code[data-lang="kql"],[data-course="threat-hunting-m365"] .rc-code[data-lang="sigma"]{background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code[data-lang="kql"],[data-course="threat-hunting-m365"] .rc-code[data-lang="sigma"]{scrollbar-color:#424854 #2d313a}[data-course="threat-hunting-m365"] .rc-code[data-lang="kql"]::-webkit-scrollbar,[data-course="threat-hunting-m365"] .rc-code[data-lang="sigma"]::-webkit-scrollbar{background:#2d313a}[data-course="threat-hunting-m365"] .rc-code[data-lang="kql"]::-webkit-scrollbar-track,[data-course="threat-hunting-m365"] .rc-code[data-lang="sigma"]::-webkit-scrollbar-track{background:#2d313a}[data-course="threat-hunting-m365"] .rc-code[data-lang="kql"]::-webkit-scrollbar-thumb,[data-course="threat-hunting-m365"] .rc-code[data-lang="sigma"]::-webkit-scrollbar-thumb{background:#424854;border:3px solid #383d47}[data-course="threat-hunting-m365"] .rc-code[data-lang="kql"]::-webkit-scrollbar-thumb:hover,[data-course="threat-hunting-m365"] .rc-code[data-lang="sigma"]::-webkit-scrollbar-thumb:hover{background:#424854}[data-course="threat-hunting-m365"] .rc-code[data-lang="json"]{background:#2d313a;color:#e3e5e8;scrollbar-color:#424854 #2d313a}[data-course="threat-hunting-m365"] .rc-code[data-lang="json"]::-webkit-scrollbar-track{background:#2d313a}[data-course="threat-hunting-m365"] .rc-code[data-lang="json"]::-webkit-scrollbar-thumb{background:#424854;border:3px solid #383d47}[data-course="threat-hunting-m365"] .rc-code[data-lang="json"]::-webkit-scrollbar-thumb:hover{background:#424854}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="json"] .cli-key{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="json"] .cli-value{color:#4ade80}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="json"] .cli-ok{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="json"] .cli-time{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code[data-lang="bash"],[data-course="threat-hunting-m365"] .rc-code[data-lang="cli-output"]{background:#1a1d23;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code[data-lang="ps-output"]{background:#1a1d23;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code[data-lang="output"],[data-course="threat-hunting-m365"] .rc-code[data-lang="event-log"],[data-course="threat-hunting-m365"] .rc-code[data-lang="syslog-output"],[data-course="threat-hunting-m365"] .rc-code[data-lang="winevent"]{background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code[data-lang="output"] code,[data-course="threat-hunting-m365"] .rc-code[data-lang="output"] span,[data-course="threat-hunting-m365"] .rc-code[data-lang="event-log"] code,[data-course="threat-hunting-m365"] .rc-code[data-lang="event-log"] span,[data-course="threat-hunting-m365"] .rc-code[data-lang="winevent"] code,[data-course="threat-hunting-m365"] .rc-code[data-lang="winevent"] span{color:#e3e5e8}[data-course="threat-hunting-m365"] .rc-code[data-lang="output"] span.evt-flag,[data-course="threat-hunting-m365"] .rc-code[data-lang="event-log"] span.evt-flag,[data-course="threat-hunting-m365"] .rc-code[data-lang="winevent"] span.evt-flag{background:rgba(122,46,14,0.16);color:#8f96a3}[data-course="threat-hunting-m365"] .code-chrome{border:1px solid #383d47}[data-course="threat-hunting-m365"] .chrome-copy{color:#8f96a3;border:1px solid #424854}[data-course="threat-hunting-m365"] .chrome-copy:hover{color:#e3e5e8;border-color:#424854}[data-course="threat-hunting-m365"] .rc-code-caption{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-code-copy{background:#20242b}[data-course="threat-hunting-m365"] .rc-code-bare:hover .rc-code-copy{border-color:#424854;color:#e3e5e8}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-console-link{background:#e86a2a;color:#23272e !important;border:1px solid #e86a2a}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-console-link:hover{background:#e86a2a;color:#23272e !important;border-color:#e86a2a}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-header{background:linear-gradient(135deg,#1c1f26,#20242b);border-bottom:1px solid #424854}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-logo{background:linear-gradient(135deg,#f5a572,#e86a2a);color:#23272e}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-subtitle{color:#8f96a3}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-toolbar{background:#20242b;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-btn-run{background:#f5a572;color:#23272e}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-btn-run:hover{background:#f5a572}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-time{color:#e3e5e8;background:#2d313a;border:1px solid #424854}[data-course="threat-hunting-m365"] .athena-chrome .chrome-header{background:linear-gradient(135deg,#20242b,#2d313a);border-bottom:1px solid #424854}[data-course="threat-hunting-m365"] .athena-chrome .chrome-logo{background:linear-gradient(135deg,#f5a572,#f5a572);color:#23272e}[data-course="threat-hunting-m365"] .athena-chrome .chrome-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .athena-chrome .chrome-subtitle{color:#8f96a3}[data-course="threat-hunting-m365"] .athena-chrome .chrome-toolbar{background:#20242b;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .athena-chrome .chrome-btn-run{background:#f5a572;color:#23272e}[data-course="threat-hunting-m365"] .athena-chrome .chrome-btn-run:hover{background:#f5a572}[data-course="threat-hunting-m365"] .athena-chrome .chrome-copy{color:#8f96a3;border:1px solid #424854}[data-course="threat-hunting-m365"] .athena-chrome .chrome-copy:hover{background:#2d313a;color:#e3e5e8}[data-course="threat-hunting-m365"] .cmd-chrome .chrome-titlebar{background:#2d313a}[data-course="threat-hunting-m365"] .cmd-chrome .chrome-cmd-icon{background:#1a1d23;border:1px solid #424854;color:#e3e5e8}[data-course="threat-hunting-m365"] .cmd-chrome .chrome-tab-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .cmd-chrome .chrome-wc{color:#e3e5e8}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-header{background:linear-gradient(135deg,#20242b,#2d313a);border-bottom:1px solid #424854}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-logo{background:linear-gradient(135deg,#e86a2a,#e86a2a);color:#23272e}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-subtitle{color:#8f96a3}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-toolbar{background:#20242b;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-file-name{color:#8f96a3}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-copy{color:#8f96a3;border-color:#424854}[data-course="threat-hunting-m365"] .velociraptor-chrome .chrome-copy:hover{color:#e3e5e8;border-color:#424854}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-header{background:linear-gradient(135deg,#1c1f26,#20242b);border-bottom:1px solid #424854}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-logo{background:linear-gradient(135deg,#4ade80,#4ade80);color:#23272e}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-subtitle{color:#8f96a3}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-toolbar{background:#20242b;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-file-name{color:#8f96a3}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-copy{color:#8f96a3;border-color:#424854}[data-course="threat-hunting-m365"] .splunk-chrome .chrome-copy:hover{color:#e3e5e8;border-color:#424854}[data-course="threat-hunting-m365"] .file-chrome .chrome-header{background:linear-gradient(135deg,#2d313a,#2d313a);border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .file-chrome .chrome-icon{background:#424854;color:#e3e5e8}[data-course="threat-hunting-m365"] .file-chrome .chrome-title{color:#8f96a3}[data-course="threat-hunting-m365"] .file-chrome .chrome-count{color:#8f96a3}[data-course="threat-hunting-m365"] .file-chrome .chrome-toolbar{background:#2d313a;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .file-chrome .chrome-copy{color:#8f96a3;border-color:#383d47}[data-course="threat-hunting-m365"] .file-chrome .chrome-copy:hover{color:#8f96a3;border-color:#424854}[data-course="threat-hunting-m365"] .results-chrome .chrome-header{background:linear-gradient(135deg,#20242b,#2d313a);border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .results-chrome .chrome-icon{background:#f5a572;color:#23272e}[data-course="threat-hunting-m365"] .results-chrome .chrome-title{color:#8f96a3}[data-course="threat-hunting-m365"] .results-chrome .chrome-count{color:#8f96a3}[data-course="threat-hunting-m365"] .results-chrome .chrome-toolbar{background:#20242b;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .results-chrome .chrome-badge{background:#20242b;color:#8f96a3}[data-course="threat-hunting-m365"] .results-chrome .chrome-copy{color:#8f96a3;border-color:#383d47}[data-course="threat-hunting-m365"] .results-chrome .chrome-copy:hover{color:#8f96a3;border-color:#424854}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-header{background:linear-gradient(180deg,#20242b,#20242b);border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-evt-icon{background:#f5a572;color:#23272e}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-title{color:#8f96a3}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-evt-comp{color:#8f96a3}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-toolbar{background:#20242b;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-evt-meta{color:#8f96a3}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-copy{color:#8f96a3;border-color:#383d47}[data-course="threat-hunting-m365"] .winevent-chrome .chrome-copy:hover{color:#8f96a3;border-color:#424854}[data-course="threat-hunting-m365"] .reveal-output-header .chrome-icon{background:#f5a572;color:#23272e}[data-course="threat-hunting-m365"] .reveal-output-header .chrome-title{color:#8f96a3}[data-course="threat-hunting-m365"] .reveal-output-header .chrome-count{color:#8f96a3}[data-course="threat-hunting-m365"] .reveal-output-header .chrome-badge{background:#20242b;color:#8f96a3}[data-course="threat-hunting-m365"] .kql-executable .chrome-btn-run.kql-run-active{background:#f5a572}[data-course="threat-hunting-m365"] .kql-executable .chrome-btn-run.kql-run-active:hover{background:#f5a572}[data-course="threat-hunting-m365"] .kql-editor-wrap{border-top:1px solid #383d47}[data-course="threat-hunting-m365"] .kql-editor{background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .kql-editor-wrap .kql-editor-hl{background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .kql-editor.kql-editor-overlay{caret-color:#e3e5e8}[data-course="threat-hunting-m365"] .kql-editor-hint{color:#8f96a3}[data-course="threat-hunting-m365"] .kql-results-panel{border-top:1px solid #424854}[data-course="threat-hunting-m365"] .kql-results-header{background:linear-gradient(135deg,#20242b,#2d313a);border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .kql-results-header.kql-results-error{background:linear-gradient(135deg,#20242b,#2d313a)}[data-course="threat-hunting-m365"] .kql-results-icon{color:#f5a572}[data-course="threat-hunting-m365"] .kql-results-error .kql-results-icon{color:#f87171}[data-course="threat-hunting-m365"] .kql-results-title{color:#8f96a3}[data-course="threat-hunting-m365"] .kql-results-count{color:#8f96a3}[data-course="threat-hunting-m365"] .kql-results-badge{background:#20242b;color:#8f96a3}[data-course="threat-hunting-m365"] .kql-error-message{color:#f87171;background:#20242b}[data-course="threat-hunting-m365"] .kql-no-results{color:#8f96a3}[data-course="threat-hunting-m365"] .kql-results-table th{background:#20242b;color:#8f96a3;border-bottom:2px solid #383d47}[data-course="threat-hunting-m365"] .kql-results-table td{border-bottom:1px solid #383d47;color:#8f96a3}[data-course="threat-hunting-m365"] .kql-results-table tr:hover td{background:#20242b}[data-course="threat-hunting-m365"] .chrome-time-badge{color:#e3e5e8;border:1px solid #424854;background:rgba(227,229,232,0.06)}[data-course="threat-hunting-m365"] .chrome-corpus-badge{color:#4ade80;background:rgba(74,222,128,.12);border:1px solid rgba(74,222,128,.12)}[data-course="threat-hunting-m365"] .chrome-qlabel{color:#8f96a3}[data-course="threat-hunting-m365"] .sentinel-chrome.sentinel-chrome.sentinel-chrome .chrome-qlabel{color:#e3e5e8}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-rowlimit{background:#2d313a;border:1px solid #424854;color:#e3e5e8}[data-course="threat-hunting-m365"] .sentinel-chrome .chrome-logo{background:#f5a572}[data-course="threat-hunting-m365"] .chrome-btn-reset{background:#2d313a;color:#e3e5e8;border:1px solid #424854}[data-course="threat-hunting-m365"] .chrome-btn-reset:hover{background:#2d313a;color:#e3e5e8}[data-course="threat-hunting-m365"] .file-chrome .chrome-tabbar{background:#2d313a;border-bottom:1px solid #424854}[data-course="threat-hunting-m365"] .file-chrome .chrome-tab{background:#20242b;border-right:1px solid #424854;border-top:2px solid #e86a2a}[data-course="threat-hunting-m365"] .file-chrome .chrome-tab-name{color:#e3e5e8}[data-course="threat-hunting-m365"] .file-chrome .chrome-tab-path{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-field{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-key{color:#f5a572}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-value{color:#4ade80}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-ok{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-time{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-muted{color:#8f96a3}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-head{color:#e86a2a}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-add{color:#4ade80}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-del{color:#f87171}[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code .cli-comment{color:#8f96a3}[data-course="threat-hunting-m365"] .kql-predict{background:#2d313a;border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .kql-predict-q{color:#e3e5e8}[data-course="threat-hunting-m365"] .kql-predict-k{color:#e3e5e8;background:#424854}[data-course="threat-hunting-m365"] .kql-predict-opt{border:1px solid #383d47;background:#20242b;color:#8f96a3}[data-course="threat-hunting-m365"] .kql-predict-opt:hover{border-color:#424854}[data-course="threat-hunting-m365"] .kql-predict-opt.is-picked{border-color:#424854;background:#2d313a;color:#e3e5e8}[data-course="threat-hunting-m365"] .kql-predict-opt.is-answer{border-color:#424854;background:#20242b;color:#8f96a3}[data-course="threat-hunting-m365"] .kql-predict-opt.is-wrong{border-color:#f87171;background:#20242b;color:#f87171}[data-course="threat-hunting-m365"] .kql-predict-why{color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable{--qf-blue:#f5a572;--qf-line:#383d47;--qf-text:#8f96a3;--qf-sub:#8f96a3;background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .chrome-toolbar.qf-bar{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .chrome-btn-run{color:#23272e}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .chrome-btn-run:hover{background:#f5a572;border-color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-icon{background:#20242b;border:1px solid #383d47}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-icon:hover,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-btn:hover{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-btn{background:#20242b;border:1px solid #383d47}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-select{border:1px solid #383d47;background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-editor-row{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-gutter{color:#8f96a3;background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-editor,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-editor-wrap .kql-editor-hl{background:#20242b !important}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-editor.kql-editor-overlay{caret-color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-keyword,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-pipe{color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-ident{color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-function{color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-string{color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-number{color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-comment{color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-results-panel{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-search{border:1px solid #383d47;background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table th{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table td{border-bottom:1px solid #383d47}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table tbody tr:hover td{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-box{border:1px solid #424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-results-header.kql-results-error{background:#20242b;color:#f87171;border-bottom:1px solid #f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-error-message{color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opts{border:1px solid #383d47;background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt{border-right:1px solid #383d47;background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt:hover{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt.is-picked{color:#23272e}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt.is-answer{background:#20242b;color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt.is-wrong{background:#20242b;color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-why{background:#20242b;color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-why.is-miss{background:rgba(232,106,42,.12)}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-said{color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-why.is-miss .qf-said{color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable{--qf-line:#424854;--qf-text:#e3e5e8;--qf-sub:#8f96a3;--qf-blue:#e86a2a;background:#20242b;border-color:#383d47}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .chrome-toolbar.qf-bar{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-qlabel{color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .chrome-btn-run{background:#e86a2a;border-color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-link{color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-icon,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-btn,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-select{background:#2d313a;border-color:#f5a572;color:#e3e5e8 !important}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-editor-row{background:#20242b;border-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-gutter{background:#20242b;color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-editor,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-editor-wrap .kql-editor-hl{background:#20242b !important;color:#e3e5e8 !important}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-editor.kql-editor-overlay{caret-color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-keyword,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-pipe{color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-ident{color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-function{color:#4ade80}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-string{color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-number{color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .tok-comment{color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-results-panel{background:#20242b;border-top-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-rtab{color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-rtab svg{color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-search{background:#2d313a;border-color:#f5a572;color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-search input{color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table th{background:#20242b;color:#e3e5e8;border-bottom-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table td{color:#e3e5e8;border-bottom-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table tbody tr:hover td{background:#2d313a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-box{border-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict{background:#2d313a;border-bottom-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opts{background:#20242b;border-color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt{background:#20242b;color:#e3e5e8;border-right-color:#f5a572}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt:hover{background:#2d313a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt.is-picked{background:#e86a2a;color:#23272e}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt.is-answer{background:#0f2418;color:#4ade80}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-opt.is-wrong{background:#2a1214;color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-why{background:#0f2418;color:#4ade80;border-top-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-why.is-miss{background:#2d313a;color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-said{color:#4ade80}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-why.is-miss .qf-said{color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .chrome-btn-run:hover{background:#e86a2a;border-color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-icon:hover,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-btn:hover{background:#2d313a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table tbody tr:hover td{background:#2d313a !important;color:#e3e5e8 !important}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable table.kql-results-table tbody tr td{background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-chev,.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-select::after{color:#8f96a3;border-color:#424854}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-editor-row:focus-within{border-color:#e86a2a}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-no-results{color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-results-header.kql-results-error{background:#2a1214;color:#f87171;border-bottom-color:#383d47}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-error-message{color:#f87171;background:#20242b}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-k{color:#8f96a3}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-predict-q{color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-results-header.kql-results-error .kql-results-title{color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .kql-results-header.kql-results-error .kql-results-icon{color:#f87171}.module-content[data-course="threat-hunting-m365"] .code-chrome.kql-executable .qf-chart{background:#20242b}[data-course="threat-hunting-m365"] .kqlx-title{fill:#e3e5e8}[data-course="threat-hunting-m365"] .kqlx-axt{fill:#8f96a3}[data-course="threat-hunting-m365"] .kqlx-tick{fill:#8f96a3}[data-course="threat-hunting-m365"] .kqlx-leg{fill:#e3e5e8}[data-course="threat-hunting-m365"] .kqlx-grid{stroke:#424854}[data-course="threat-hunting-m365"] .kqlx-axis{stroke:#424854}[data-course="threat-hunting-m365"] .kqlx-legend{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-start{background:#2d313a;border:1px solid #383d47}[data-course="threat-hunting-m365"] .kce-start-title{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-start-desc{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-start-meta{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-meta-item strong{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-meta-sep{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-start-btn{background:#e86a2a;color:#23272e}[data-course="threat-hunting-m365"] .kce-start-btn:hover{background:#e86a2a}[data-course="threat-hunting-m365"] .kce-progress-bar{background:#2d313a}[data-course="threat-hunting-m365"] .kce-progress-fill{background:#e86a2a}[data-course="threat-hunting-m365"] .kce-progress-text{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-timer{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-question-body{background:#2d313a;border:1px solid #383d47}[data-course="threat-hunting-m365"] .kce-scenario-label{color:#e86a2a}[data-course="threat-hunting-m365"] .kce-scenario-text{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-option{background:#20242b;border:2px solid #383d47;color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-option:hover{border-color:#e86a2a;background:#20242b}[data-course="threat-hunting-m365"] .kce-option-letter{background:#2d313a;color:#8f96a3}[data-course="threat-hunting-m365"] .kce-option:hover .kce-option-letter{background:#e86a2a;color:#23272e}[data-course="threat-hunting-m365"] .kce-option.kce-correct{border-color:#4ade80;background:rgba(74,222,128,.12)}[data-course="threat-hunting-m365"] .kce-option.kce-correct .kce-option-letter{background:#4ade80;color:#23272e}[data-course="threat-hunting-m365"] .kce-option.kce-wrong{border-color:#f87171;background:rgba(248,113,113,.12)}[data-course="threat-hunting-m365"] .kce-option.kce-wrong .kce-option-letter{background:#f87171;color:#23272e}[data-course="threat-hunting-m365"] .kce-feedback{border:1px solid #383d47}[data-course="threat-hunting-m365"] .kce-feedback-correct .kce-feedback-header{background:rgba(74,222,128,.12);color:#4ade80}[data-course="threat-hunting-m365"] .kce-feedback-incorrect .kce-feedback-header{background:rgba(248,113,113,.12);color:#f87171}[data-course="threat-hunting-m365"] .kce-feedback-wrong,[data-course="threat-hunting-m365"] .kce-feedback-right{border-top:1px solid #383d47}[data-course="threat-hunting-m365"] .kce-feedback-wrong{background:rgba(248,113,113,.12)}[data-course="threat-hunting-m365"] .kce-feedback-right{background:rgba(74,222,128,.12)}[data-course="threat-hunting-m365"] .kce-feedback-section-label{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-feedback-wrong p,[data-course="threat-hunting-m365"] .kce-feedback-right p{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-feedback-expl{color:#8f96a3 !important}[data-course="threat-hunting-m365"] .kce-next-btn{background:#20242b;color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-next-btn:hover{background:#2d313a}[data-course="threat-hunting-m365"] .kce-results-time{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-results-breakdown{background:#20242b;border:1px solid #383d47}[data-course="threat-hunting-m365"] .kce-results-breakdown h4{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-result-row{border-bottom:1px solid #383d47;color:#8f96a3}[data-course="threat-hunting-m365"] .kce-result-num{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-result-time{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-result-wrong{background:rgba(248,113,113,.12)}[data-course="threat-hunting-m365"] .kce-review{background:#2d313a;border:1px solid #383d47}[data-course="threat-hunting-m365"] .kce-review h4{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-review-item{border-bottom:1px solid #383d47}[data-course="threat-hunting-m365"] .kce-review-q{color:#e3e5e8}[data-course="threat-hunting-m365"] .kce-review-answer{color:#4ade80}[data-course="threat-hunting-m365"] .kce-review-expl{color:#8f96a3}[data-course="threat-hunting-m365"] .kce-restart-btn{background:#2d313a;color:#e3e5e8;border:2px solid #383d47}[data-course="threat-hunting-m365"] .kce-restart-btn:hover{border-color:#e86a2a;background:#20242b}.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor){position:relative;background:var(--dx-bg);color:var(--dx-text);border:1px solid var(--dx-line);border-radius:10px;box-shadow:0 18px 40px -28px rgba(26,29,35,.85);overflow:hidden;font-size:14.5px;line-height:1.55;margin:18px 0 24px;padding:0}.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor)::before{content:"";position:absolute;inset:0 0 auto 0;height:1px;background:linear-gradient(90deg,transparent,var(--dx-cyan) 30%,transparent 85%);opacity:.7;z-index:1}.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) p,.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) li{color:inherit}.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) b,.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) strong{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) pre.rc-code,.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) pre{margin:0;background:var(--dx-code);border:1px solid var(--dx-line);border-radius:8px;padding:12px 14px;overflow-x:auto;font:13px/1.6 var(--dx-mono);font-variant-ligatures:none;color:var(--dx-text);white-space:pre;box-shadow:none}.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) pre code{background:none;padding:0;font:inherit;color:inherit;border:0}.module-content[data-course="threat-hunting-m365"] *:is(pre,code,textarea,.kqlc-editor){font-variant-ligatures:none;font-feature-settings:"liga" 0,"calt" 0}.module-content[data-course="threat-hunting-m365"] *:is(.rc-refine,.rc-decode,.rc-procedure,.rc-gate,.rc-verdict,.rc-console,.rc-threat,.detection-tabs,.rc-transform,.kql-challenge,.rc-testrun,.rc-record,.rc-strike,.rc-ladder,.rc-tree,.rc-consequence,.config-auditor) code{background:var(--dx-raise);color:var(--dx-text);border-radius:4px}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-tabs{display:flex;gap:2px;align-items:center;padding:8px 10px 0;background:linear-gradient(#20242b,#1c1f26);border:0;border-bottom:1px solid var(--dx-line);margin:0}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-tab{appearance:none;border:0;background:none;color:var(--dx-dim);font:600 12px/1 var(--dx-mono);letter-spacing:.06em;padding:9px 14px 10px;border-radius:7px 7px 0 0;cursor:pointer;position:relative;margin:0}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-tab:hover{color:var(--dx-text);background:none}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-tab.active{color:var(--dx-text);background:var(--dx-bg);border:0}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-tab.active::after{content:"";position:absolute;left:10px;right:10px;bottom:-1px;height:2px;background:var(--dx-cyan);box-shadow:0 0 10px var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-panel{padding:12px;background:transparent;border:0}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-panel pre{border:0;background:transparent;padding:4px 4px 2px}.module-content[data-course="threat-hunting-m365"] .detection-tabs .dt-toolbar,.module-content[data-course="threat-hunting-m365"] .detection-tabs [class*="dt-bar"]{background:var(--dx-panel);border-top:1px solid var(--dx-line);color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .detection-tabs a.dt-console-link{color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-refine{padding:14px 16px}.module-content[data-course="threat-hunting-m365"] .rc-refine-step{display:grid;grid-template-columns:132px minmax(0,1fr);gap:14px;padding:10px 0;border:0;background:none;margin:0}.module-content[data-course="threat-hunting-m365"] .rc-refine-step + .rc-refine-step{border-top:1px dashed var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-refine-tag{font:700 11px/1.3 var(--dx-mono);letter-spacing:.08em;text-transform:uppercase;color:var(--dx-dim);padding-top:4px;background:none}.module-content[data-course="threat-hunting-m365"] .rc-refine-sub{display:block;margin-top:4px;font:500 12px/1.4 inherit;letter-spacing:0;text-transform:none;color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .rc-refine-step.is-first .rc-refine-tag{color:var(--dx-amber)}.module-content[data-course="threat-hunting-m365"] .rc-refine-step.is-better .rc-refine-tag{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-refine-res{margin-top:8px;font-size:13.5px;color:var(--dx-dim);background:none;border:0;padding:0}.module-content[data-course="threat-hunting-m365"] .rc-refine-res b{font-family:var(--dx-mono);font-weight:600}.module-content[data-course="threat-hunting-m365"] .rc-refine-step.is-gap .rc-refine-gap{grid-column:2;border:0;border-left:2px solid var(--dx-red);background:var(--dx-red-bg);padding:9px 12px;border-radius:0 6px 6px 0;font-size:13.5px;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-gate-grid{display:grid;grid-template-columns:1fr 1.5fr 1fr;gap:0;background:none;border:0}.module-content[data-course="threat-hunting-m365"] .rc-gate-grid > div{padding:14px 16px;min-width:0;background:none;border:0;border-radius:0}.module-content[data-course="threat-hunting-m365"] .rc-gate-grid > .rc-gate-alert{border-right:1px solid var(--dx-line);background:linear-gradient(180deg,var(--dx-red-bg),transparent 70%)}.module-content[data-course="threat-hunting-m365"] .rc-gate-grid > .rc-gate-check{border-right:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-gate-k{display:block;margin-bottom:6px;font:600 10.5px/1.2 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-gate-t{display:block;font-weight:600;font-size:15px;color:var(--dx-text);margin-bottom:8px}.module-content[data-course="threat-hunting-m365"] .rc-gate-body{display:block;font-size:13.5px;color:var(--dx-dim);margin-top:8px}.module-content[data-course="threat-hunting-m365"] .rc-gate-meta{display:inline-block;margin-top:10px;font:600 11px/1.3 var(--dx-mono);color:var(--dx-red);border:1px solid rgba(248,113,113,.4);padding:5px 8px;border-radius:5px;background:none}.module-content[data-course="threat-hunting-m365"] .rc-gate-check pre{font-size:12px}.module-content[data-course="threat-hunting-m365"] .rc-gate-grid > .rc-gate-outs{display:flex;flex-direction:column;gap:10px}.module-content[data-course="threat-hunting-m365"] .rc-gate-out{border-radius:8px;padding:10px 12px;border:1px solid var(--dx-line);background:none}.module-content[data-course="threat-hunting-m365"] .rc-gate-out.is-yes{border-color:rgba(74,222,128,.45);background:var(--dx-green-bg)}.module-content[data-course="threat-hunting-m365"] .rc-gate-out.is-yes .rc-gate-k,.module-content[data-course="threat-hunting-m365"] .rc-gate-out .rc-gate-meta{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-gate-out .rc-gate-meta{border-color:rgba(74,222,128,.4)}.module-content[data-course="threat-hunting-m365"] .rc-gate-out.is-no{border-color:rgba(251,191,36,.4);background:var(--dx-amber-bg)}.module-content[data-course="threat-hunting-m365"] .rc-gate-out.is-no .rc-gate-k{color:var(--dx-amber)}.module-content[data-course="threat-hunting-m365"] .rc-gate-foot{padding:10px 16px;border-top:1px solid var(--dx-line);background:var(--dx-panel);font-size:13.5px;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-verdict{display:grid;grid-template-columns:1fr 1fr;gap:0}.module-content[data-course="threat-hunting-m365"] .rc-verdict .rc-vd-pane:is(.is-wrong,.is-right){padding:14px 16px;min-width:0;display:flex;flex-direction:column;gap:10px;background:none;border:0;border-radius:0;margin:0;box-shadow:none}.module-content[data-course="threat-hunting-m365"] .rc-verdict .rc-vd-pane:is(.is-wrong,.is-right) + .rc-vd-pane{border-left:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-verdict .rc-vd-pane:is(.is-wrong,.is-right) .rc-vd-head{display:flex;gap:10px;align-items:center;font:600 14px/1.3 'Inter',system-ui,sans-serif;color:var(--dx-text);background:none;border:0;padding:0}.module-content[data-course="threat-hunting-m365"] .rc-vd-tag{font:700 10.5px/1 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;padding:5px 8px;border-radius:5px}.module-content[data-course="threat-hunting-m365"] .rc-verdict .is-wrong .rc-vd-tag{color:var(--dx-red);background:var(--dx-red-bg);border:1px solid rgba(248,113,113,.4)}.module-content[data-course="threat-hunting-m365"] .rc-verdict .is-right .rc-vd-tag{color:var(--dx-green);background:var(--dx-green-bg);border:1px solid rgba(74,222,128,.4)}.module-content[data-course="threat-hunting-m365"] .rc-vd-pane pre{font-size:12px}.module-content[data-course="threat-hunting-m365"] .rc-verdict .rc-vd-pane:is(.is-wrong,.is-right) .rc-vd-out{font:13.5px/1.5 'Inter',system-ui,sans-serif;color:var(--dx-dim);display:flex;gap:8px;background:none;border:0;padding:0;white-space:normal}.module-content[data-course="threat-hunting-m365"] .rc-verdict .rc-vd-pane.is-wrong .rc-vd-out .rc-vd-k{color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .rc-verdict .rc-vd-pane.is-right .rc-vd-out .rc-vd-k{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-verdict .rc-vd-pane:is(.is-wrong,.is-right) .rc-vd-out .rc-vd-v{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-strike{padding:14px 16px;gap:0}.module-content[data-course="threat-hunting-m365"] .rc-strike-label,.module-content[data-course="threat-hunting-m365"] .rc-ladder-label,.module-content[data-course="threat-hunting-m365"] .rc-tree-label{font:600 10.5px/1.3 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;color:var(--dx-dim);margin-bottom:6px}.module-content[data-course="threat-hunting-m365"] .rc-strike-row{border-bottom:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-strike-old{color:var(--dx-red);text-decoration-color:rgba(248,113,113,.7)}.module-content[data-course="threat-hunting-m365"] .rc-strike-new{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-strike-why,.module-content[data-course="threat-hunting-m365"] .rc-strike-fix:has(code) .rc-strike-why{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] *:is(.rc-strike-rule,.rc-ladder-rule){background:var(--dx-panel);border:0;border-left:2px solid var(--dx-cyan);border-radius:0 6px 6px 0;color:var(--dx-text);margin:12px 0 0}.module-content[data-course="threat-hunting-m365"] .rc-ladder{padding:14px 16px}.module-content[data-course="threat-hunting-m365"] .rc-ladder-rung{background:var(--dx-panel);border:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-tier{font-family:var(--dx-mono);font-size:11.5px;letter-spacing:.06em;text-transform:uppercase;background:var(--dx-raise);color:var(--dx-text);border:1px solid var(--dx-line2)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-rung[data-tier="1"] .rc-ladder-tier{color:var(--dx-red);background:var(--dx-red-bg);border-color:rgba(248,113,113,.45)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-rung[data-tier="2"] .rc-ladder-tier{color:var(--dx-amber);background:var(--dx-amber-bg);border-color:rgba(251,191,36,.45)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-rung[data-tier="3"] .rc-ladder-tier{color:var(--dx-cyan);background:var(--dx-cyan-bg);border-color:rgba(232,106,42,.45)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-rung[data-tier="4"] .rc-ladder-tier{color:var(--dx-green);background:var(--dx-green-bg);border-color:rgba(74,222,128,.45)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-band{color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-mean{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-ladder-commit{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-tree{padding:14px 16px}.module-content[data-course="threat-hunting-m365"] .rc-tree-body{background:var(--dx-code);border:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-tree-line.is-mark{background:var(--dx-cyan-bg)}.module-content[data-course="threat-hunting-m365"] .rc-tree-line{grid-template-columns:minmax(0,1fr) minmax(0,1.3fr) 84px 56px}.module-content[data-course="threat-hunting-m365"] .rc-tree-name{color:var(--dx-text);white-space:normal;overflow-wrap:anywhere}.module-content[data-course="threat-hunting-m365"] .rc-tree-note{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-tree-tag{color:var(--dx-cyan);border-color:rgba(232,106,42,.4)}.module-content[data-course="threat-hunting-m365"] .rc-tree-tag:empty{border:0}.module-content[data-course="threat-hunting-m365"] .rc-tree-mod{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .rc-decode{padding:16px 16px 6px}.module-content[data-course="threat-hunting-m365"] .rc-decode-step{display:grid;grid-template-columns:28px minmax(0,1fr);gap:14px;position:relative;padding:0 0 16px;border:0;background:none;margin:0}.module-content[data-course="threat-hunting-m365"] .rc-decode-step::before{content:"";position:absolute;left:13px;top:28px;bottom:0;width:1px;background:var(--dx-line2)}.module-content[data-course="threat-hunting-m365"] .rc-decode-step:last-child::before{display:none}.module-content[data-course="threat-hunting-m365"] .rc-decode-n{width:28px;height:28px;border-radius:50%;display:grid;place-items:center;font:600 12px/1 var(--dx-mono);color:var(--dx-cyan);border:1px solid rgba(232,106,42,.5);background:var(--dx-cyan-bg)}.module-content[data-course="threat-hunting-m365"] .rc-decode-cap{font-size:13.5px;color:var(--dx-dim);margin:3px 0 8px}.module-content[data-course="threat-hunting-m365"] .rc-decode-cap b{font-family:var(--dx-mono);font-weight:600}.module-content[data-course="threat-hunting-m365"] .rc-decode-hl{color:var(--dx-cyan);background:none;text-shadow:0 0 12px rgba(232,106,42,.45)}.module-content[data-course="threat-hunting-m365"] .rc-decode-step.is-yield .rc-decode-n{color:#23272e;background:var(--dx-cyan);border-color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-decode-ioc{display:inline-block;margin:4px 6px 0 0;font:500 12px/1 var(--dx-mono);color:var(--dx-text);border:1px solid var(--dx-line2);background:var(--dx-raise);padding:6px 8px;border-radius:5px}.module-content[data-course="threat-hunting-m365"] .rc-procedure-head{display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap;align-items:baseline;padding:12px 16px;border:0;border-bottom:1px solid var(--dx-line);background:var(--dx-panel)}.module-content[data-course="threat-hunting-m365"] .rc-procedure-title{font-weight:600;font-size:15px;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-procedure-tool{font:500 11.5px/1 var(--dx-mono);color:var(--dx-dim);background:none;border:0}.module-content[data-course="threat-hunting-m365"] .rc-procedure-step{display:grid;grid-template-columns:minmax(0,.9fr) minmax(0,1.2fr);gap:16px;padding:12px 16px;border:0;border-bottom:1px solid var(--dx-line);background:none;margin:0}.module-content[data-course="threat-hunting-m365"] .rc-procedure-h{font-weight:600;font-size:14px;display:flex;gap:10px;align-items:baseline;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-procedure-n{font:600 12px/1 var(--dx-mono);color:var(--dx-cyan);background:none;border:0;width:auto;height:auto}.module-content[data-course="threat-hunting-m365"] .rc-procedure-why{font-size:13px;color:var(--dx-dim);margin:4px 0 6px}.module-content[data-course="threat-hunting-m365"] .rc-procedure-tag{font:500 10.5px/1 var(--dx-mono);letter-spacing:.06em;text-transform:uppercase;color:var(--dx-faint);background:none;border:0;padding:0}.module-content[data-course="threat-hunting-m365"] .rc-procedure-step pre{font-size:12px}.module-content[data-course="threat-hunting-m365"] .rc-procedure-foot{padding:10px 16px;border:0;background:var(--dx-panel);font-size:13px;color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-console{font-family:var(--dx-mono);font-size:12.5px}.module-content[data-course="threat-hunting-m365"] .rc-console-top{display:flex;justify-content:space-between;gap:10px;padding:10px 14px;background:var(--dx-panel);border:0;border-bottom:1px solid var(--dx-line);color:var(--dx-text);font-weight:600}.module-content[data-course="threat-hunting-m365"] .rc-console-live{color:var(--dx-red);display:inline-flex;align-items:center;gap:6px;background:none;border:0}.module-content[data-course="threat-hunting-m365"] .rc-console-live::before{content:"";width:7px;height:7px;border-radius:50%;background:var(--dx-red);animation:dx-pulse 1.8s infinite}.module-content[data-course="threat-hunting-m365"] .rc-console-target{padding:10px 14px;display:flex;gap:12px;align-items:baseline;border:0;border-bottom:1px solid var(--dx-line);background:none}.module-content[data-course="threat-hunting-m365"] .rc-console-k{color:var(--dx-faint);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase}.module-content[data-course="threat-hunting-m365"] .rc-console-v{color:var(--dx-cyan);font-size:14px}.module-content[data-course="threat-hunting-m365"] .rc-console-meta{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:0;border:0;border-bottom:1px solid var(--dx-line);background:none}.module-content[data-course="threat-hunting-m365"] .rc-console-meta > div{padding:9px 14px;color:var(--dx-text);background:none;border:0}.module-content[data-course="threat-hunting-m365"] .rc-console-meta > div + div{border-left:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-console-stages{padding:6px 0;border:0;border-bottom:1px solid var(--dx-line);background:none}.module-content[data-course="threat-hunting-m365"] .rc-console-stage{display:grid;grid-template-columns:30px 16px minmax(0,1fr) auto;gap:8px;padding:5px 14px;align-items:baseline;background:none;border:0}.module-content[data-course="threat-hunting-m365"] .rc-console-n{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .rc-console-stage[data-state="done"] .rc-console-mark,.module-content[data-course="threat-hunting-m365"] .rc-console-stage[data-state="done"] .rc-console-state{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-console-stage[data-state="queued"]{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .rc-console-note{color:var(--dx-dim);margin-left:6px}.module-content[data-course="threat-hunting-m365"] .rc-console-finding{padding:10px 14px;border:0;border-bottom:1px solid var(--dx-line);border-left:2px solid var(--dx-green);background:none;border-radius:0;margin:0}.module-content[data-course="threat-hunting-m365"] .rc-console-finding.is-inferred{border-left-color:var(--dx-amber)}.module-content[data-course="threat-hunting-m365"] .rc-console-finding:last-child{border-bottom:0}.module-content[data-course="threat-hunting-m365"] .rc-console-fhead{display:flex;justify-content:space-between;color:var(--dx-faint);font-size:10.5px;letter-spacing:.08em;text-transform:uppercase;background:none;border:0;padding:0}.module-content[data-course="threat-hunting-m365"] .rc-console-ftitle{display:block;color:var(--dx-text);font:600 14px/1.4 'Inter',system-ui,sans-serif;margin:4px 0 6px}.module-content[data-course="threat-hunting-m365"] .rc-console-fields{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:4px 12px;color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-threat-top{display:flex;justify-content:space-between;gap:10px;flex-wrap:wrap;align-items:baseline;padding:12px 16px;border:0;border-bottom:1px solid var(--dx-line);background:radial-gradient(120% 140% at 0% 0%,var(--dx-red-bg),transparent 60%)}.module-content[data-course="threat-hunting-m365"] .rc-threat-name{font:700 18px/1.2 var(--dx-mono);color:var(--dx-red);text-shadow:0 0 14px rgba(248,113,113,.35)}.module-content[data-course="threat-hunting-m365"] .rc-threat-case{font:500 11.5px/1 var(--dx-mono);color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-threat-grid{display:grid;grid-template-columns:1fr 1.3fr 1fr;gap:0;background:none;border:0}.module-content[data-course="threat-hunting-m365"] .rc-threat-grid > div{padding:14px 16px;display:flex;flex-direction:column;gap:7px;min-width:0;background:none;border:0;border-radius:0}.module-content[data-course="threat-hunting-m365"] .rc-threat-grid > .rc-threat-core{border-left:1px solid var(--dx-line);border-right:1px solid var(--dx-line);background:var(--dx-panel)}.module-content[data-course="threat-hunting-m365"] .rc-threat-k{font:600 10.5px/1.2 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-threat-chip{font:500 12px/1.3 var(--dx-mono);color:var(--dx-text);border:1px solid var(--dx-line2);background:var(--dx-raise);padding:6px 8px;border-radius:5px;overflow-wrap:anywhere}.module-content[data-course="threat-hunting-m365"] .rc-threat-col.is-did .rc-threat-chip{border-color:rgba(248,113,113,.35)}.module-content[data-course="threat-hunting-m365"] .rc-threat-path{font:500 12.5px/1.45 var(--dx-mono);color:var(--dx-cyan);overflow-wrap:anywhere}.module-content[data-course="threat-hunting-m365"] .rc-threat-hash,.module-content[data-course="threat-hunting-m365"] .rc-threat-seen{font-size:12.5px;color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-threat-stats{display:grid;grid-template-columns:repeat(3,1fr);border:0;border-top:1px solid var(--dx-line);background:none}.module-content[data-course="threat-hunting-m365"] .rc-threat-stat{padding:12px 16px;background:none;border:0}.module-content[data-course="threat-hunting-m365"] .rc-threat-stat + .rc-threat-stat{border-left:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-threat-n{display:block;font:700 24px/1 var(--dx-mono);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-threat-stat:last-child .rc-threat-n{color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .rc-threat-sl{font-size:12px;color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-transform{display:grid;grid-template-columns:minmax(0,1fr) 40px minmax(0,1fr);align-items:stretch;padding:14px 16px;gap:8px}.module-content[data-course="threat-hunting-m365"] .rc-transform-pane{display:flex;flex-direction:column;gap:8px;min-width:0;background:none;border:0;padding:0}.module-content[data-course="threat-hunting-m365"] .rc-transform-label{font:600 10.5px/1 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;color:var(--dx-amber);background:none}.module-content[data-course="threat-hunting-m365"] .rc-transform-pane.is-after .rc-transform-label{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-transform-pane pre{flex:1;font-size:12px}.module-content[data-course="threat-hunting-m365"] .rc-transform-arrow{display:grid;place-items:center;color:var(--dx-cyan);font:600 20px/1 var(--dx-mono);background:none}.module-content[data-course="threat-hunting-m365"] .rc-record{padding:16px 18px}.module-content[data-course="threat-hunting-m365"] .rc-record p.rc-record-title{color:var(--dx-text);font:600 15.5px/1.35 'Inter',system-ui,sans-serif;margin:0 0 8px}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-pill{color:var(--dx-cyan);background:var(--dx-cyan-bg);border:1px solid rgba(232,106,42,.4);font-family:var(--dx-mono)}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-pill.is-good{color:var(--dx-green);background:var(--dx-green-bg);border-color:rgba(74,222,128,.4)}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-pill.is-warn{color:var(--dx-amber);background:var(--dx-amber-bg);border-color:rgba(251,191,36,.4)}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-pill.is-bad{color:var(--dx-red);background:var(--dx-red-bg);border-color:rgba(248,113,113,.4)}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-meta{background:none;border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-meta > div{background:none;border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-record p.rc-record-k{color:var(--dx-dim);font-family:var(--dx-mono);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase}.module-content[data-course="threat-hunting-m365"] .rc-record p.rc-record-v,.module-content[data-course="threat-hunting-m365"] .rc-record p.rc-record-p,.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-list li{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-sec,.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-sec-t{color:var(--dx-dim);border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-head{background:var(--dx-panel);border-bottom:1px solid var(--dx-line);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-tag{color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-meta,.module-content[data-course="threat-hunting-m365"] .rc-testrun-cx,.module-content[data-course="threat-hunting-m365"] .rc-testrun-line{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-row{border-color:var(--dx-line);background:none}.module-content[data-course="threat-hunting-m365"] .rc-testrun-row.is-head,.module-content[data-course="threat-hunting-m365"] .rc-testrun-corner{background:var(--dx-panel);color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-cn,.module-content[data-course="threat-hunting-m365"] .rc-testrun-rn{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-cell{background:none;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-cell.is-good .rc-testrun-mark{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-cell.is-bad{background:var(--dx-red-bg)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-cell.is-bad .rc-testrun-mark{color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-cell.is-none .rc-testrun-mark{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-res{border-left-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-res.is-pass{color:var(--dx-green);background:var(--dx-green-bg)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-res.is-mid{color:var(--dx-amber);background:var(--dx-amber-bg)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-res.is-fail{color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .rc-testrun code{background:var(--dx-raise);color:var(--dx-cyan);border:1px solid var(--dx-line2)}.module-content[data-course="threat-hunting-m365"] .rc-testrun-foot{background:var(--dx-panel);color:var(--dx-text);border-top:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-inner{background:none;border:0;border-radius:0;padding:0;margin:0;box-shadow:none}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-header{display:flex;gap:10px;align-items:center;flex-wrap:wrap;padding:11px 16px;border:0;border-bottom:1px solid var(--dx-line);background:var(--dx-panel);margin:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-kind{font:700 10.5px/1 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;color:#23272e;background:var(--dx-cyan);padding:5px 8px;border-radius:5px;border:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-title{font-weight:600;font-size:15px;flex:1;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-status{font:500 11.5px/1 var(--dx-mono);color:var(--dx-dim);background:none;border:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-passed{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-body{padding:12px 16px 14px;display:flex;flex-direction:column;gap:10px;background:none}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-prompt{margin:0;font-size:14px;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-expect{display:flex;gap:10px;align-items:baseline;flex-wrap:wrap;font-size:13px;color:var(--dx-dim);background:none;border:0;padding:0;margin:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-expect-k{font:600 10.5px/1 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-expect-v{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-hints{margin:0;padding-left:20px;color:var(--dx-dim);font-size:13.5px}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-editor-wrap{border:1px solid var(--dx-line);border-radius:8px;overflow:hidden;background:var(--dx-code);margin:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-editor-bar{display:flex;justify-content:space-between;padding:6px 12px;font:500 11px/1.4 var(--dx-mono);color:var(--dx-faint);border:0;border-bottom:1px solid var(--dx-line);background:none}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tables{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-editor{display:block;width:100%;border:0;outline:0;resize:vertical;background:transparent;color:var(--dx-text);font:13px/1.6 var(--dx-mono);font-variant-ligatures:none;font-feature-settings:"liga" 0,"calt" 0;padding:10px 12px;field-sizing:content;min-height:4.8em;margin:0;box-shadow:none}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-hlbox{position:relative}.module-content[data-course="threat-hunting-m365"] .kql-challenge pre.kqlc-hl{position:absolute;inset:0;margin:0;padding:10px 12px;background:none;border:0;border-radius:0;box-shadow:none;overflow:hidden;pointer-events:none;font:13px/1.6 var(--dx-mono);font-variant-ligatures:none;color:var(--dx-text);white-space:pre-wrap;overflow-wrap:anywhere;tab-size:4}.module-content[data-course="threat-hunting-m365"] .kql-challenge pre.kqlc-hl code{font:inherit;color:inherit;background:none;padding:0;border:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge textarea.kqlc-editor.kqlc-editor-hl{position:relative;color:transparent;caret-color:var(--dx-cyan);background:transparent;white-space:pre-wrap;overflow-wrap:anywhere;tab-size:4}.module-content[data-course="threat-hunting-m365"] .kql-challenge textarea.kqlc-editor.kqlc-editor-hl::selection{background:rgba(232,106,42,.28);color:transparent}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-keyword{color:#f5a572}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-pipe{color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-function{color:#f5a572}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-string{color:#fde68a}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-number{color:#86efac}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-comment{color:#858b97;font-style:italic}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-var{color:#fbbf24}.module-content[data-course="threat-hunting-m365"] .kqlc-hl .tok-ident{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-editor:focus-visible{box-shadow:inset 0 0 0 1px var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-actions{display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-btn{appearance:none;cursor:pointer;font:600 12.5px/1 'Inter',system-ui,sans-serif;padding:8px 12px;border-radius:6px;border:1px solid var(--dx-line2);background:var(--dx-raise);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-btn:disabled{opacity:.45;cursor:not-allowed}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-btn-run{border-color:var(--dx-cyan);background:var(--dx-cyan);color:#23272e}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-btn:focus-visible{outline:2px solid var(--dx-cyan);outline-offset:2px}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-kbd{font:500 11px/1 var(--dx-mono);color:var(--dx-faint);background:none;border:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg{font-size:13.5px;padding:10px 12px;border-radius:7px;border:1px solid var(--dx-line2);background:var(--dx-panel);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg-pass{border-color:rgba(74,222,128,.45);background:var(--dx-green-bg)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg-pass strong{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg-fail{border-color:rgba(251,191,36,.4);background:var(--dx-amber-bg)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg-fail strong{color:var(--dx-amber)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg-error{border-color:rgba(248,113,113,.4);background:var(--dx-red-bg)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg-error strong{color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg ul{display:flex;gap:6px;flex-wrap:wrap;list-style:none;padding:0;margin:8px 0 0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-msg li{font:500 11.5px/1.2 var(--dx-mono);padding:6px 8px;border-radius:5px;border:1px solid var(--dx-line2);background:var(--dx-raise);margin:0;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-output table{font-family:var(--dx-mono);font-size:12.5px;color:var(--dx-text);background:var(--dx-code);border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-output th{color:var(--dx-dim);background:var(--dx-panel);border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-output td{border-color:var(--dx-line);background:none;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-teaching,.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-solution{background:var(--dx-panel);border:1px solid var(--dx-line);border-radius:8px;padding:10px 12px;color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-teaching-label,.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-solution-label{font:600 10.5px/1.2 var(--dx-mono);letter-spacing:.1em;text-transform:uppercase;color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-teaching-text,.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-solution-note{color:var(--dx-dim);margin:6px 0 0}.module-content[data-course="threat-hunting-m365"] .kce-engine{background:var(--dx-bg);border:1px solid var(--dx-line);border-radius:10px;padding:18px 20px;color:var(--dx-text);box-shadow:0 18px 40px -28px rgba(26,29,35,.85)}.module-content[data-course="threat-hunting-m365"] .rc-map{background:var(--dx-bg);border:1px solid var(--dx-line);border-radius:10px;padding:14px 16px;box-shadow:0 18px 40px -28px rgba(26,29,35,.85)}.module-content[data-course="threat-hunting-m365"] .rc-map .rc-map-head *:is(h2,h3,.rc-map-t,.rc-map-title){color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-code-bare > pre.rc-code{background:var(--dx-panel);border:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .kql-challenge-set li::marker{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] *:is(.code-chrome,.kql-challenge-set,.kql-challenge) .chrome-btn-run,.module-content[data-course="threat-hunting-m365"] *:is(.code-chrome,.kql-challenge-set,.kql-challenge) .chrome-btn-run:hover{color:#23272e}.module-content[data-course="threat-hunting-m365"] *:is(.code-chrome,.kql-challenge-set,.kql-challenge) .chrome-btn-run svg{color:#23272e;stroke:currentColor}.module-content[data-course="threat-hunting-m365"] .kql-challenge *:is(.kqlc-results-head,.kqlc-empty,.kqlc-truncated){color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] table{border-color:var(--dx-line);box-shadow:none;background:var(--dx-code)}.module-content[data-course="threat-hunting-m365"] th{background:var(--dx-panel);color:var(--dx-dim);border-bottom-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] td{color:var(--dx-text);border-bottom-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] tbody tr:nth-child(even){background:transparent}.module-content[data-course="threat-hunting-m365"] tbody tr:hover{background:var(--dx-raise)}.module-content[data-course="threat-hunting-m365"] td code{color:var(--dx-text);background:none}.module-content[data-course="threat-hunting-m365"] th code{color:var(--dx-amber);background:var(--dx-raise)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-knobs{display:flex;flex-wrap:wrap;gap:10px 18px;padding:12px 14px;border:1px solid var(--dx-line);border-radius:8px;background:var(--dx-panel)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-knob{display:flex;align-items:center;gap:10px;font-size:13.5px;color:var(--dx-text);margin:0;cursor:pointer}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-knob-range{flex:1 1 100%}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-knob-label{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-knob input[type=range]{flex:1;accent-color:var(--dx-cyan);min-width:120px}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-knob input[type=checkbox]{accent-color:var(--dx-cyan);width:16px;height:16px;margin:0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-knob-value{font:600 12.5px/1 var(--dx-mono);color:var(--dx-cyan);min-width:4.5em;text-align:right}.module-content[data-course="threat-hunting-m365"] .kql-challenge pre.kqlc-tune-query{border:0;border-radius:0;white-space:pre-wrap;overflow-wrap:anywhere}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tune-note{font-size:12.5px;color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tune-board{display:grid;grid-template-columns:repeat(auto-fit,minmax(130px,1fr));gap:8px;margin:10px 0 0}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tune-cell{display:flex;flex-direction:column;gap:4px;padding:8px 10px;border:1px solid var(--dx-line2);border-radius:6px;background:var(--dx-raise)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tune-cell.is-bad{border-color:rgba(251,191,36,.5)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tune-k{font:600 10px/1.2 var(--dx-mono);letter-spacing:.08em;text-transform:uppercase;color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tune-v{font:600 15px/1.2 var(--dx-mono);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-tune-cell.is-bad .kqlc-tune-v{color:var(--dx-amber)}.module-content[data-course="threat-hunting-m365"] .diagram-container{background:none;border:0;padding:0;box-shadow:none;margin:24px 0}.module-content[data-course="threat-hunting-m365"] .diagram-container[data-dx-anim]{margin-bottom:8px}.module-content[data-course="threat-hunting-m365"] .diagram-container svg{border-radius:10px;box-shadow:0 18px 40px -28px rgba(26,29,35,.85)}.module-content[data-course="threat-hunting-m365"] [data-dx-anim] .dx-cell{transition:none}.module-content[data-course="threat-hunting-m365"] [data-dx-anim].run .dx-cell.is-fail{animation:dx-fail .25s ease-out both;animation-delay:calc(var(--i) * 45ms)}.module-content[data-course="threat-hunting-m365"] [data-dx-anim].run .dx-cell.is-ok{animation:dx-failok 1.3s ease-out both;animation-delay:calc(var(--i) * 45ms)}.module-content[data-course="threat-hunting-m365"] [data-dx-anim].run .dx-count{animation:dx-in .4s ease-out both;animation-delay:3.6s}.module-content[data-course="threat-hunting-m365"] .dx-replay{appearance:none;cursor:pointer;font:600 11.5px/1 var(--dx-mono);color:var(--dx-cyan);background:var(--dx-bg);border:1px solid rgba(232,106,42,.5);padding:6px 10px;border-radius:5px;margin:-6px 0 18px}.module-content[data-course="threat-hunting-m365"] .dx-replay:focus-visible{outline:2px solid var(--dx-cyan);outline-offset:2px}@media (max-width:680px){.module-content[data-course="threat-hunting-m365"] *:is(.rc-gate-grid,.rc-verdict,.rc-threat-grid,.rc-procedure-step,.rc-transform){grid-template-columns:1fr}}@media (max-width:680px){.module-content[data-course="threat-hunting-m365"] .rc-gate-grid >:is(.rc-gate-alert,.rc-gate-check),.module-content[data-course="threat-hunting-m365"] .rc-threat-grid > .rc-threat-core{border-right:0;border-left:0;border-bottom:1px solid var(--dx-line)}}@media (max-width:680px){.module-content[data-course="threat-hunting-m365"] .rc-vd-pane + .rc-vd-pane{border-left:0;border-top:1px solid var(--dx-line)}}@media (max-width:680px){.module-content[data-course="threat-hunting-m365"] .rc-transform-arrow{transform:rotate(90deg);padding:4px 0}}@media (max-width:680px){.module-content[data-course="threat-hunting-m365"] .rc-refine-step{grid-template-columns:1fr;gap:6px}}@media (max-width:680px){.module-content[data-course="threat-hunting-m365"] .rc-refine-step.is-gap .rc-refine-gap{grid-column:1}}@media (max-width:680px){.module-content[data-course="threat-hunting-m365"] .rc-console-meta{grid-template-columns:repeat(2,minmax(0,1fr))}}@media (prefers-reduced-motion:reduce){.module-content[data-course="threat-hunting-m365"] [data-dx-anim].run *:is(.dx-cell,.dx-count),.module-content[data-course="threat-hunting-m365"] .rc-console-live::before{animation:none}}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-results-wrap{background:var(--dx-code);border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .kql-challenge table.kqlc-results th{background:var(--dx-panel);color:var(--dx-dim);border-bottom-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .kql-challenge table.kqlc-results td{background:var(--dx-code);color:var(--dx-text);border-bottom-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .kql-challenge table.kqlc-results tr{background:var(--dx-code)}.module-content[data-course="threat-hunting-m365"] .kql-challenge input:is([type="checkbox"],[type="range"]){accent-color:var(--dx-cyan);background:transparent}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-complete pre.kqlc-code{background:var(--dx-code) !important;color:var(--dx-text) !important}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-blank{background:var(--dx-raise);color:var(--dx-amber);border-bottom-color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-blank::placeholder{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-blank:focus{background:var(--dx-line);box-shadow:0 0 0 1px var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-blank.is-ok{color:var(--dx-green);border-bottom-color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-blank.is-wrong{color:var(--dx-red);border-bottom-color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-blank-count{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .pc-callout{background:var(--dx-bg);border:1px solid var(--dx-line);border-left:3px solid #93c5fd;border-radius:10px;box-shadow:0 18px 40px -28px rgba(26,29,35,.85);margin:18px 0 24px;position:relative}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-header{background:linear-gradient(#20242b,#1c1f26);border-bottom:1px solid var(--dx-line);padding:11px 16px}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-portal-name{color:var(--dx-text);letter-spacing:.12em;font-family:var(--dx-mono);font-size:11px}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-icon svg rect:first-child{fill:#93c5fd}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-url-link{background:var(--dx-raise);border-color:var(--dx-line2)}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-url-text{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-url-link:hover{border-color:#93c5fd;background:var(--dx-raise)}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-url-link:hover .pc-url-text{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-external{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-breadcrumb{padding:12px 16px 10px}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-crumb{background:var(--dx-raise);border-color:var(--dx-line2);color:var(--dx-text);font-family:var(--dx-mono);font-size:12px}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-crumb:last-of-type{background:rgba(147,197,253,.14);border-color:#93c5fd;color:#ede9fe}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-arrow{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-instruction{color:var(--dx-text);border-top:1px solid var(--dx-line);padding:12px 16px 16px;font-size:14px}.module-content[data-course="threat-hunting-m365"] .pc-callout .pc-instruction strong{color:#ede9fe}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-head{background:linear-gradient(#20242b,#1c1f26);border-bottom:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-head .rc-aid-label{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-disc{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-brief{color:var(--dx-text) !important}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-brief strong{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-art{background:var(--dx-panel);border:1px solid var(--dx-line);box-shadow:none}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-art-label{color:var(--dx-dim);border-bottom:1px solid var(--dx-line);font-family:var(--dx-mono);letter-spacing:.08em}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-art-label span{color:var(--dx-faint);font-family:var(--dx-mono)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-art pre{border:0;border-radius:0 !important;background:var(--dx-code)}.module-content[data-course="threat-hunting-m365"] .rc-consequence *:is(.rc-cq-req){background:var(--dx-panel);border-left-color:var(--dx-line2);box-shadow:none}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-req .rc-aid-label{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-req p{color:var(--dx-text) !important}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-req p strong{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-ask{background:var(--dx-panel);border:1px solid var(--dx-line);box-shadow:none}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-q{color:var(--dx-text) !important}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-grp-h{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o{background:var(--dx-raise);border-color:var(--dx-line2);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o:hover:not(:disabled){background:var(--dx-raise);border-color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o:focus-visible{outline-color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o[aria-pressed="true"]{background:var(--dx-cyan-bg);border-color:var(--dx-cyan);box-shadow:inset 0 0 0 1px var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o *:is(.k,.num){background:var(--dx-line);color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o[aria-pressed="true"] *:is(.k,.num){background:var(--dx-cyan);color:#23272e}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o.is-right{background:var(--dx-green-bg);border-color:var(--dx-green);box-shadow:inset 0 0 0 1px var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o.is-right *:is(.k,.num){background:var(--dx-green);color:#23272e}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o.is-wrong{background:var(--dx-red-bg);border-color:var(--dx-red);box-shadow:inset 0 0 0 1px var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o.is-wrong *:is(.k,.num){background:var(--dx-red);color:#23272e}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-o.is-missed{background:var(--dx-amber-bg);border-color:var(--dx-amber)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-seqbar{background:var(--dx-panel);border-color:var(--dx-line2)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-seqbar .ph{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-chip{background:var(--dx-raise);color:var(--dx-text);border:1px solid var(--dx-line2)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-go{background:var(--dx-cyan);color:#23272e}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-go:hover:not(:disabled){background:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-go:disabled{background:var(--dx-raise);color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-go:focus-visible{outline-color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-hint{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-reset{border-color:var(--dx-line2);color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-reset:hover{border-color:var(--dx-dim);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict{background:var(--dx-panel);border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict.right{background:var(--dx-green-bg);border-color:rgba(74,222,128,.35);border-left-color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict.wrong{background:var(--dx-red-bg);border-color:rgba(248,113,113,.35);border-left-color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict.committed{background:var(--dx-panel);border-color:var(--dx-line);border-left-color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict.right .rc-aid-label{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict.wrong .rc-aid-label{color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict.committed .rc-aid-label{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-verdict p{color:var(--dx-text) !important}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-why{background:var(--dx-panel);border-left-color:var(--dx-cyan);box-shadow:none;border-top:1px solid var(--dx-line);border-right:1px solid var(--dx-line);border-bottom:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-why-h{background:var(--dx-cyan-bg);border-bottom:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-why-h p{color:var(--dx-cyan) !important}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-why-b p{color:var(--dx-text) !important}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-why-b strong{color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-why-b code{background:var(--dx-raise);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-diff{background:var(--dx-code)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-dl{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-dl:hover:not(:disabled){background:var(--dx-raise)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-dctx{color:var(--dx-faint)}.module-content[data-course="threat-hunting-m365"] .rc-consequence .rc-cq-difftip{color:var(--dx-dim) !important}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-header{background:linear-gradient(#20242b,#1c1f26);border-bottom:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-badge{background:var(--dx-amber);color:#23272e}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-title{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-header-right{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-hdr-btn{background:var(--dx-raise);border-color:var(--dx-line2);color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-context-text{background:var(--dx-panel);color:var(--dx-text);border-bottom:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-config-pane{border-bottom:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor *:is(.ca-config-label,.ca-results-badge,.ca-fix-label,.ca-decoys-label){color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .config-auditor pre.ca-config-code{background:var(--dx-code);border:1px solid var(--dx-line);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-config-code .ca-ln{background:var(--dx-code);color:var(--dx-faint);border-right-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-config-code mark{background:var(--dx-amber);color:#23272e}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-instruction{color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .config-auditor *:is(.ca-empty,.ca-gap-card){background:var(--dx-panel);border-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-empty-lead{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-empty-qs li{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-empty-note{color:var(--dx-dim);border-top-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor *:is(.ca-gap-num,.ca-gap-label,.ca-result-header){color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor *:is(.ca-gap-desc,.ca-result-pts,.ca-results-detail,.ca-unmark){color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-gap-hint{color:var(--dx-amber)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-gap-value{background:var(--dx-raise);border-color:var(--dx-line2);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor *:is(.ca-gap-input,.ca-gap-select){background:var(--dx-code);border-color:var(--dx-line2);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor *:is(.ca-gap-input,.ca-gap-select):focus{outline-color:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-hint-btn{border-color:var(--dx-line2);color:var(--dx-dim)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-actions{border-top:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-btn{background:var(--dx-raise);border-color:var(--dx-line2);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-btn-submit{background:var(--dx-cyan);border-color:var(--dx-cyan);color:#23272e}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-btn-submit:hover{background:var(--dx-cyan)}.module-content[data-course="threat-hunting-m365"] .config-auditor *:is(.ca-results,.ca-result-row,.ca-result-remediation,.ca-result-model,.ca-decoy){color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-results-score{color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-result-item{border-top-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-result-model{border-left-color:var(--dx-line2)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-result-missed{border-left-color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-ok{color:var(--dx-green)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-wrong{color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-miss{background:var(--dx-red-bg);border-color:rgba(248,113,113,.4);color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-error{background:var(--dx-red-bg);border-color:rgba(248,113,113,.4);color:var(--dx-red)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-decoys{border-top-color:var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-decoy code{background:var(--dx-raise);border-color:var(--dx-line2);color:var(--dx-text)}.module-content[data-course="threat-hunting-m365"] .config-auditor .ca-fix-code{background:var(--dx-code);border:1px solid var(--dx-line)}.module-content[data-course="threat-hunting-m365"] .rc-code[data-lang="powershell"],.module-content[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="powershell"]{background:#012456;color:#cccccc;border-color:#012456}.module-content[data-course="threat-hunting-m365"] .rc-code-bare:has(> .rc-code[data-lang="powershell"]){background:#012456;border-color:#012456}.module-content[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="powershell"] .ps-cmdlet{color:#eeedf0}.module-content[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="powershell"] .ps-param{color:#fdba74}.module-content[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="powershell"] .ps-str{color:#86efac}.module-content[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="powershell"] .ps-var{color:#fca5a5}.module-content[data-course="threat-hunting-m365"] .rc-code-bare > .rc-code[data-lang="powershell"] .ps-prompt{color:#86c06c}.module-content[data-course="threat-hunting-m365"] *:is(.rc-section,.module-quicklinks,.mql-item,.rc-code,.code-chrome,.kql-challenge,.kql-challenge-set,.kql-results-table,.rc-action,.rc-action-out,.rc-accept,.rc-map,.rc-map-row,.rc-tree,.rc-ladder,.rc-ladder-rung,.rc-verdict,.rc-vd-pane,.rc-record,.rc-consequence,.rc-aid,.rc-gate-grid,.rc-chip,.rc-tool,.knowledge-check,.kce-option,.kc-option,.detection-tabs,.results-chrome,.file-chrome,.sentinel-chrome){border-radius:0}.module-content[data-course="threat-hunting-m365"] .code-chrome *:is(button,.qf-btn){border-radius:0}.module-content[data-course="threat-hunting-m365"] a{text-decoration-color:rgba(109,40,217,.4)}.module-content[data-course="threat-hunting-m365"] .module-content-inner a:not([class]){color:#c2410c}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root{--rct-bg:#20242b;--rct-panel:#272b33;--rct-panel2:#333842;--rct-line:#383d47;--rct-ink:#e3e5e8;--rct-soft:#cbd5e1;--rct-muted:#8f96a3;--rct-cyan:#e86a2a;--rct-green:#4ade80;--rct-amber:#fbbf24;--rct-red:#f87171}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="hunt-notebook"]{--hn-bg:#20242b;--hn-page:#272b33;--hn-cell:#2d313a;--hn-grid:#1c1f26;--hn-line:#383d47;--hn-line2:#424854;--hn-ink:#e3e5e8;--hn-dim:#8f96a3;--hn-faint:#7a818e;--hn-amber:#e86a2a;--hn-amber-bg:rgba(232,106,42,.12);--hn-teal:#f5a572;--hn-ok:#4ade80;--hn-ok-bg:rgba(74,222,128,.10);--hn-no:#f87171;--hn-no-bg:rgba(248,113,113,.10)}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="hunt-notebook"] *:is(button.hn-run,button.hn-primary){color:#23272e}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="evidence-questions"]{--eq-bg:#20242b;--eq-panel:#272b33;--eq-raise:#333842;--eq-grid:#1c1f26;--eq-zebra:#1e2129;--eq-line:#383d47;--eq-line2:#424854;--eq-ink:#e3e5e8;--eq-dim:#8f96a3;--eq-faint:#7a818e;--eq-accent:#e86a2a;--eq-accent-bg:rgba(232,106,42,.12);--eq-ok:#4ade80;--eq-ok-bg:rgba(74,222,128,.13);--eq-no:#f87171;--eq-no-bg:rgba(248,113,113,.12);--eq-warn:#fbbf24;--eq-warn-bg:rgba(251,191,36,.13)}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="evidence-questions"] .eq-head{background:#272b33}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="evidence-questions"] table.eq-grid thead th{background:#272b33}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="evidence-questions"] table.eq-grid tbody tr:hover td{background:#252930}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="evidence-questions"] table.eq-grid td.eq-empty::after{color:#424854}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root[data-tool="evidence-questions"] *:is(.eq-opt .eq-mark,.eq-fileicon){color:#23272e}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root:is([data-tool="hunt-notebook"],[data-tool="evidence-questions"]),.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root:is([data-tool="hunt-notebook"],[data-tool="evidence-questions"]) *:is(details,button,input,textarea,select,.hn-cell-body,.hn-q,.hn-grid-wrap,.eq-q,.eq-tab,.eq-pane,.eq-file,.eq-btn,.eq-card){border-radius:0}.module-content[data-course="threat-hunting-m365"] *:is(.rc-map,.rc-action,.rc-accept,.rc-tree,.rc-ladder,.kql-challenge,.code-chrome){box-shadow:none}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-list li.is-good{background:rgba(74,222,128,.09);border-left:3px solid #4ade80;color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-list li.is-fault{background:rgba(248,113,113,.10);border-left:3px solid #f87171;color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-list li.is-good strong{color:#86efac}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-list li.is-fault strong{color:#fca5a5}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-list li.is-good::before,.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-list li.is-fault::before{display:none}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-sec-t{font:600 15px/1.4 'Inter','IBM Plex Sans',sans-serif;color:#e3e5e8}.module-content[data-course="threat-hunting-m365"] .rc-record .rc-record-pill + .rc-record-sec{margin-top:14px}.module-content[data-course="threat-hunting-m365"] .ht-decision-why,.module-content[data-course="threat-hunting-m365"] .rc-record-v,.module-content[data-course="threat-hunting-m365"] .kql-challenge .kqlc-prompt,.module-content[data-course="threat-hunting-m365"] .rc-accept:is(p,li),.module-content[data-course="threat-hunting-m365"] .rc-accept-ct,.module-content[data-course="threat-hunting-m365"] .rc-accept-locked,.module-content[data-course="threat-hunting-m365"] .rc-action:is(p,li,strong),.module-content[data-course="threat-hunting-m365"] .rc-action-note,.module-content[data-course="threat-hunting-m365"] .rc-action-out,.module-content[data-course="threat-hunting-m365"] .rc-console-v,.module-content[data-course="threat-hunting-m365"] .rc-refine-step.is-gap .rc-refine-gap,.module-content[data-course="threat-hunting-m365"] .rc-refine-res{font-size:13px}.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root:is(p,li,dd,dt):not(.hn-meta,.rct-panel-title),.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root:is(.eq-dim,.hn-dim,.pw-dim),.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root p.eq-prompt,.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root p.hn-q,.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root .eq-opt,.module-content[data-course="threat-hunting-m365"] .rc-tool.rct-root textarea.hn-note-in{font-size:13px}