MDATP
-
Updated
Jul 20, 2024 - PowerShell
MDATP
Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
Contains Entra Related PowerShell Scripts and Entra Related KQL for Logs in Log Analytics
Sentinel Analytics Rule converter PowerShell module
A collection of sample dashboards, custom labels, mustaches, SQL scripts and PowerShell scripts to help you get the most out of SquaredUp. #community-powered
Welcome to the Cloud Security Toolkit repository, your all-in-one destination for cutting-edge cloud security resources! Whether you're diving into offensive strategies, mastering threat hunting, or bolstering your blue-team defenses, this repo has you covered.
Defender XDR Advanced Hunting Queries (MDE, MDAV, Device Discovery)
A comprehensive collection of Kusto Query Language (KQL) queries designed for security professionals to detect, hunt, and respond to cyber threats and incidents, covering areas like Detections, Digital Forensics, and Hunting by Entity (Device, Email, User), and including operational queries for incident management and analytics tuning.
PowerShell Module that extracts data from Microsoft Azure using ARG KQL queries running in PowerShell. The extracted data can be exported to CSV, Excel, JSON reports, mitigating the maximum rows limitation of ARG Explorer on Azure.
CyberThreat Monitor (SIEM Lab) with Microsoft Azure is a comprehensive threat monitoring solution built on Azure Sentinel, providing real-time visibility into global cyber threats.
Microsoft related PowerShell scripts and KQL queries
Implemented a miniature HoneyNet on Azure, integrating log sources from diverse resources into a Log Analytics workspace.
This repo contains content which ist related to my blog https://hoferlabs.ch/.
This repository offers tools and scripts for mapping and visualizing Microsoft Sentinel data. It includes utilities for extracting, analyzing, and presenting security information from Sentinel, helping to create detailed security maps and dashboards for improved threat analysis.
Azure Resource Graph learnings with Azure PowerShell, Azure CLI and VS Code
Sample files shared at the architect day(s) 19th-20th of November
Add a description, image, and links to the kql topic page so that developers can more easily learn about it.
To associate your repository with the kql topic, visit your repo's landing page and select "manage topics."