Search Results - RepositoryStats

Hunting-Queries-Detection-Rules Bert-JanP

199

1.1k

bsd-3-clause

53

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

kql mde mdi dfir misp azure infosec blueteam security sentinel zero-day cybersecurity threat-hunting defender-for-endpoint vulnerability-management

Created 2022-05-30

321 commits to main branch, last one a day ago

sentinel-attack netevert

208

1.0k

mit

71

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

kql siem azure sysmon logging blue-team detection workbooks mitre-attack cybersecurity sysmon-config azure-sentinel security-tools threat-hunting terraform-azure

Created 2019-05-30

313 commits to master branch, last one 9 months ago

FalconFriday FalconForceTeam

76

676

bsd-3-clause

54

Hunting queries and detections

kql hunting blueteam sentinel purpleteam defender-atp defender-for-endpoint

Created 2020-08-04

98 commits to master branch, last one 22 hours ago

Threat-Hunting-and-Detection Cyb3r-Monk

93

570

bsd-3-clause

29

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

kql dfir cybersecurity kusto-language threat-hunting threat-detection microsoft-sentinel defender-for-endpoint detection-engineering

Created 2020-11-02

22 commits to main branch, last one 5 months ago

KQL-threat-hunting-queries cyb3rmik3

54

467

mit

9

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

kql kusto security sentinel microsoft kusto-query threat-hunt microsoftxdr microsoft-365 microsoft-xdr securitycenter threat-hunting threat-detecting threat-detection microsoft-security microsoft-sentinel kusto-query-language microsoft-365-defender microsoft-365-security

Created 2022-07-19

309 commits to main branch, last one 4 days ago

MDATP alexverboon

59

453

mit

33

Microsoft Defender XDR - Resource Hub

kql blogs learning threathunting defender-for-endpoint defender-for-identity microsoft-defender-xdr defender-for-cloud-apps defender-for-office-365

Created 2019-06-15

207 commits to master branch, last one 12 days ago

KQL LearningKijo

70

413

unknown

21

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

edr kql xdr kusto threat-hunting incident-response

Created 2022-12-12

802 commits to main branch, last one 14 days ago

MDE-DFIR-Resources cyb3rmik3

37

316

mit

10

A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

kql mde dfir kusto microsoft resources kusto-query curated-list live-response digital-forensics incident-response curated-collections kusto-query-language microsoft-defender-for-endpoint digital-forensics-incident-response

Created 2023-11-01

48 commits to main branch, last one about a month ago

blue-teaming-with-kql ashwin-patil

38

194

mit

10

Repository with Sample KQL Query examples for Threat Hunting

kql siem azure security blueteaming loganalytics azure-sentinel threat-hunting azure-data-explorer

Created 2020-10-23

17 commits to main branch, last one about a year ago

kql getkirby

5

141

mit

16

Kirby's Query Language API combines the flexibility of Kirby's data structures, the power of GraphQL and the simplicity of REST.

api cms kql json kirby query flat-file file-based headless-cms query-language

Created 2020-01-15

109 commits to main branch, last one 7 months ago

AdvancedHuntingQueries lawndoc

14

99

unlicense

5

Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant

kql xdr kusto hunting defender security detection microsoft defender-atp microsoft365 cybersecurity cyber-security threat-hunting defender-for-endpoint detection-engineering

Created 2021-08-13

139 commits to main branch, last one 7 months ago

Copilot-for-Security rod-trent

15

95

mit

4

My personal work with Copilot for Security

kql code copilot plugins prompts security

Created 2023-10-28

617 commits to main branch, last one a day ago

Sentinel_KQL ep3p

20

93

mit

5

In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).