Collection of KQL queries

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

Code included as part of the MustLearnKQL blog series

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Microsoft Threat Intelligence Security Tools

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

This repo aims to help you decipher the UAL from a Digital Forensics & Incident Response (DFIR) perspective. The UAL is the Microsoft 365 Unified Audit Log.