Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.

KQL Queries. Microsoft Defender, Microsoft Sentinel

Updated Sigma2KQL script written by @CodeByHarri + Generating Analytics & Hunting Rules ready for Sentinel Deployment

Contains Entra Related PowerShell Scripts and Entra Related KQL for Logs in Log Analytics

✨ Hanley.cloud

Ian Hanley's deceptively simple KQL queries.

Defender Resource Hub

My personal work with Copilot for Security

KQL Sentinel and Defender Detection and Hunting Queries.

Hunting Queries for Defender ATP

Collection of KQL queries for sentinel and defender for organization wide monitoring

A comprehensive collection of Kusto Query Language (KQL) queries designed for security professionals to detect, hunt, and respond to cyber threats and incidents, covering areas like Detections, Digital Forensics, and Hunting by Entity (Device, Email, User), and including operational queries for incident management and analytics tuning.

C# KQL query engine with flexible I/O layers and visualization

In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

This repository contains a selection of Kusto Query Language (KQL) queries designed for proactive threat hunting. Aligned with the MITRE ATT&CK framework, these queries are crafted to detect and address potential threats effectively.

KQL Queries. Microsoft Defender, Microsoft Sentinel

Sentinel Analytics Rule converter PowerShell module

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant