Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.
-
Updated
Aug 17, 2024
Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.
KQL Queries. Microsoft Defender, Microsoft Sentinel
Updated Sigma2KQL script written by @CodeByHarri + Generating Analytics & Hunting Rules ready for Sentinel Deployment
Contains Entra Related PowerShell Scripts and Entra Related KQL for Logs in Log Analytics
Ian Hanley's deceptively simple KQL queries.
KQL Sentinel and Defender Detection and Hunting Queries.
Hunting Queries for Defender ATP
Collection of KQL queries for sentinel and defender for organization wide monitoring
A comprehensive collection of Kusto Query Language (KQL) queries designed for security professionals to detect, hunt, and respond to cyber threats and incidents, covering areas like Detections, Digital Forensics, and Hunting by Entity (Device, Email, User), and including operational queries for incident management and analytics tuning.
C# KQL query engine with flexible I/O layers and visualization
Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
This repository contains a selection of Kusto Query Language (KQL) queries designed for proactive threat hunting. Aligned with the MITRE ATT&CK framework, these queries are crafted to detect and address potential threats effectively.
Sentinel Analytics Rule converter PowerShell module
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant
Add a description, image, and links to the kql topic page so that developers can more easily learn about it.
To associate your repository with the kql topic, visit your repo's landing page and select "manage topics."