kql

There are 10 repositories under kql topic.

Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
azure defender-for-endpoint dfir kql sentinel threat-hunting vulnerability-management zero-day blueteam cybersecurity mde mdi infosec security misp
Language:Python 1580
sentinel-attack
edoardogerosa / sentinel-attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
siem threat-hunting azure-sentinel mitre-attack sysmon sysmon-config azure blue-team cybersecurity logging security-tools detection kql workbooks terraform-azure
1073
FalconForceTeam / FalconFriday
Hunting queries and detections
kql blueteam hunting purpleteam sentinel defender-atp defender-for-endpoint
844
Threat-Hunting-and-Detection
Cyb3r-Monk / Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
threat-hunting threat-detection cybersecurity defender-for-endpoint detection-engineering dfir kql kusto-language microsoft-sentinel
Language:Jupyter Notebook 791
SlimKQL / Hunting-Queries-Detection-Rules
KQL Queries. Microsoft Defender, Microsoft Sentinel
azure defenderxdr kql sentinel threatdetection defender microsoft mitre-attack threathunting
Language:JavaScript 774
cyb3rmik3 / KQL-threat-hunting-queries
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
kql kusto microsoft securitycenter sentinel kusto-query kusto-query-language microsoft-365 microsoft-365-defender microsoft-365-security microsoft-security microsoft-sentinel security threat-detection threat-hunt threat-hunting threat-detecting microsoft-xdr microsoftxdr
742
KQL
LearningKijo / KQL
Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
kql threat-hunting edr xdr incident-response kusto
483
MDATP
alexverboon / MDATP
MDATP
blogs defender-for-endpoint defender-for-identity kql learning microsoft-defender-xdr threathunting defender-for-cloud-apps defender-for-office-365
Language:PowerShell 459
cyb3rmik3 / MDE-DFIR-Resources
A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.
curated-collections curated-list dfir digital-forensics digital-forensics-incident-response incident-response live-response mde microsoft microsoft-defender-for-endpoint resources kql kusto kusto-query kusto-query-language
414
ashwin-patil / blue-teaming-with-kql
Repository with Sample KQL Query examples for Threat Hunting
threat-hunting blueteaming azure-data-explorer azure-sentinel kql security siem loganalytics azure
217
Security-Copilot
rod-trent / Security-Copilot
My personal work with Copilot for Security
code copilot kql plugins prompts security
Language:HTML 195
alexverboon / Hunting-Queries-Detection-Rules
KQL Queries. Microsoft Defender, Microsoft Sentinel
detection kql security sentinel dfir hunting defenderforendpoint defenderforidentity azure azuread defenderxdr entraid
183
wortell / KQL
KQL queries for Advanced Hunting
kql security hunting
176
getkirby / kql
Kirby's Query Language API combines the flexibility of Kirby's data structures, the power of GraphQL and the simplicity of REST.
kirby cms api query flat-file file-based headless-cms query-language json kql kirby4 kirby5
Language:PHP 151
ep3p / Sentinel_KQL
In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).
microsoft security azure kql watchlist kusto sentinel siem entra entra-id microsoft-sentinel
Language:XSLT 131
f-bader / AzSentinelQueries
Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.
analytic-rules detections hacktoberfest kql kusto sentinel threat-hunting
Language:Bicep 131
lawndoc / AdvancedHuntingQueries
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant.
security cybersecurity kusto kql hunting threat-hunting detection detection-engineering microsoft microsoft365 defender-for-endpoint defender defender-atp cyber-security xdr
129
NeilMacMullen / kusto-loco
C# KQL query engine with flexible I/O layers and visualization
charting data-mining data-visualization kql kusto
Language:C# 111
tobiasmcvey / kusto-queries
example queries for learning the kusto language
kusto-language kql kusto azure application-insights
104
jischell-msft / RemoteManagementMonitoringTools
Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
defender-for-endpoint kql mde security threat-hunting remotemanagement rmm
Language:PowerShell 98
globalbao / awesome-kql
Collection of awesome KQL queries for use in Portal and via PowerShell - by @JesseLoudon
azure kql resource-graph kusto-language azure-resource-graph azgraph
90
0xAnalyst / DefenderATPQueries
Hunting Queries for Defender ATP
defender-atp detection-engineering detection-rules kql microsoft sentinel threat-hunting
82
DXC-0 / SOC-Ressources
Repository for SOC analysts, queries to investigate, advanced hunting, sites for analysis, malware samples, courses to improve skills, IOC and monitoring.
cybersecurity cyberdefense edr siem soc threathunting socanalyst blueteam blueteam-tools cyber-threat-intelligence cybersecurity-tools security aql kql mde qradar splunk threat-hunting soc-analyst soc-analysts
79
SentinelARConverter
f-bader / SentinelARConverter
Sentinel Analytics Rule converter PowerShell module
hacktoberfest cyber-security kql sentinel
Language:PowerShell 65
EEN421 / KQL-Queries
Ian Hanley's deceptively simple KQL queries.
azure cloud-security cybersecurity devsecops kql microsoft-sentinel
62
HybridBrothers / Hunting-Queries-Detection-Rules
The purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious behavior
defender-for-cloud-apps defender-for-endpoint defender-for-identity defender-xdr entra-id kql microsoft microsoft-security microsoft-sentinel
59
cylaris / awesomekql
Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs
detection-rules siem azure detection kql
54
eshlomo1 / CloudSec
Welcome to the Cloud Security Toolkit repository, your all-in-one destination for cutting-edge cloud security resources! Whether you're diving into offensive strategies, mastering threat hunting, or bolstering your blue-team defenses, this repo has you covered.
aws-security azure azure-security cloud-security cloudsecurity dfir gcp-security incident-response kql microsoft microsoft-sentinel microsoftsentinel siem soc threat-hunting threat-intelligence cfir
Language:PowerShell 37
davidnx / baby-kusto-csharp
A self-contained execution engine for the Kusto Query Language (KQL) written in C#
kusto azure-data-explorer data-science kql
Language:C# 36
Azure / pykusto
Query Kusto like a pro from the comfort of your Jupyter notebook
kusto azure-data-explorer query-builder kql analytics jupyter-notebook
Language:Python 32
noodlemctwoodle / pf-azure-sentinel
Parse pfSense/OPNSense logs using Logstash, GeoIP tag entities, add additional context to logs, then send to Azure Sentinel for analysis.
azure-sentinel pfsense-logs geoip logstash parse pfsense maxmind maxmind-geoip firewall-logs visualization opnsense opnsense-firewall pfsense-firewall opnsense-logs monitor kql linux-oms sentinel sentinel-dashboard analytics
31
ugurkocde / KQL-Search
azure intune kql security
Language:JavaScript 31
alexverboon / DefenderResourceHub
Defender Resource Hub
defender edr kql mde mdi mdo sentinel xdr mdci
Language:PowerShell 29
microsoft / Fabric-RTA-FlightStream
Microsoft Fabric Real-time Analytics flight streaming
etl kql lakehouse powerbi pyspark-notebook streaming
Language:Jupyter Notebook 21
christosgalano / sKaleQL
sKaleQL is an opinionated template repository for managing, executing, and organizing Kusto Query Language (KQL) queries against Azure Log Analytics Workspaces.
automation azure devops devsecops github-actions kql template-repository kusto-query-language log-analytics security
19
squaredup / samples
A collection of sample dashboards, custom labels, mustaches, SQL scripts and PowerShell scripts to help you get the most out of SquaredUp. #community-powered
powershell-scripts mustache dashboards sql-scripts squaredup community-answers kql kusto json powershell dashboard samples
Language:PowerShell 19

kql

Bert-JanP / Hunting-Queries-Detection-Rules

edoardogerosa / sentinel-attack

FalconForceTeam / FalconFriday

Cyb3r-Monk / Threat-Hunting-and-Detection

SlimKQL / Hunting-Queries-Detection-Rules

cyb3rmik3 / KQL-threat-hunting-queries

LearningKijo / KQL

alexverboon / MDATP

cyb3rmik3 / MDE-DFIR-Resources

ashwin-patil / blue-teaming-with-kql

rod-trent / Security-Copilot

alexverboon / Hunting-Queries-Detection-Rules

wortell / KQL

getkirby / kql

ep3p / Sentinel_KQL

f-bader / AzSentinelQueries

lawndoc / AdvancedHuntingQueries

NeilMacMullen / kusto-loco

tobiasmcvey / kusto-queries

jischell-msft / RemoteManagementMonitoringTools

globalbao / awesome-kql

0xAnalyst / DefenderATPQueries

DXC-0 / SOC-Ressources

f-bader / SentinelARConverter

EEN421 / KQL-Queries

HybridBrothers / Hunting-Queries-Detection-Rules

cylaris / awesomekql

eshlomo1 / CloudSec

davidnx / baby-kusto-csharp

Azure / pykusto

noodlemctwoodle / pf-azure-sentinel

ugurkocde / KQL-Search

alexverboon / DefenderResourceHub

microsoft / Fabric-RTA-FlightStream

christosgalano / sKaleQL

squaredup / samples