KQL queries for Microsoft Defender Advanced Hunting organized around the TTPs of the MITRE ATT&CK framework.
-
Updated
Nov 7, 2024
#
advanced-hunting
Here are 5 public repositories matching this topic...
Defender XDR Advanced Hunting Queries (MDE, MDAV, Device Discovery)
-
Updated
Nov 26, 2025 - PowerShell
Defender for Identity Technical Items
-
Updated
Apr 9, 2025
✨ A linting tool for working with Microsoft Sentinel & Defender Advanced Hunting KQL
microsoft linter vscode defender microsoft-azure microsoft365 kql kusto-query-language microsoft-security microsoft-sentinel advanced-hunting microsoft-opensource
-
Updated
Sep 18, 2025 - C#
Collection of KQL queries for sentinel and defender for organization wide monitoring
query monitoring azure sentinel defender pim hunting monitoring-tool privilege kusto kql advanced-hunting
-
Updated
Jul 8, 2025
Improve this page
Add a description, image, and links to the advanced-hunting topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the advanced-hunting topic, visit your repo's landing page and select "manage topics."