Hunting Queries for Defender ATP

Slides presented at https://www.meetup.com/m365sandcug/events/302644214

In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).

KQL Queries. Microsoft Defender, Microsoft Sentinel

An assortment of resources pertaining to Defender XDR and Microsoft Sentinel, such as KQL hunting queries and workbooks.

KQL Queries. Microsoft Defender, Microsoft Sentinel

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

A comprehensive collection of Kusto Query Language (KQL) queries designed for security professionals to detect, hunt, and respond to cyber threats and incidents, covering areas like Detections, Digital Forensics, and Hunting by Entity (Device, Email, User), and including operational queries for incident management and analytics tuning.

My personal work with Copilot for Security

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Welcome to the Cloud Security Toolkit repository, your all-in-one destination for cutting-edge cloud security resources! Whether you're diving into offensive strategies, mastering threat hunting, or bolstering your blue-team defenses, this repo has you covered.

Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.

Kusto Query Language parser and planner for DataFusion

KQL Queries, Microsoft 365 Security

KQL queries for Microsoft Defender Advanced Hunting organized around the TTPs of the MITRE ATT&CK framework.

Defender XDR Advanced Hunting Queries (MDE, MDAV, Device Discovery)

Contains Entra Related PowerShell Scripts and Entra Related KQL for Logs in Log Analytics

C# KQL query engine with flexible I/O layers and visualization

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

✨ Hanley.cloud