kql

There are 7 repositories under kql topic.

sentinel-attack
netevert / sentinel-attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
azure azure-sentinel blue-team cybersecurity detection kql logging mitre-attack security-tools siem sysmon sysmon-config terraform-azure threat-hunting workbooks
Language:HCL 1038
Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
azure blueteam cybersecurity defender-for-endpoint dfir infosec kql mde mdi misp security sentinel threat-hunting vulnerability-management zero-day
Language:Python 997
FalconForceTeam / FalconFriday
Hunting queries and detections
kql blueteam hunting purpleteam sentinel defender-atp defender-for-endpoint
652
Threat-Hunting-and-Detection
Cyb3r-Monk / Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
cybersecurity defender-for-endpoint detection-engineering dfir kql kusto-language microsoft-sentinel threat-detection threat-hunting
Language:Jupyter Notebook 561
MDATP
alexverboon / MDATP
Microsoft Defender XDR - Resource Hub
blogs defender-for-endpoint defender-for-identity kql learning microsoft-defender-xdr threathunting defender-for-cloud-apps defender-for-office-365
Language:PowerShell 447
cyb3rmik3 / KQL-threat-hunting-queries
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
kql kusto kusto-query kusto-query-language microsoft microsoft-365 microsoft-365-defender microsoft-365-security microsoft-security microsoft-sentinel microsoft-xdr microsoftxdr security securitycenter sentinel threat-detecting threat-detection threat-hunt threat-hunting
394
KQL
LearningKijo / KQL
Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
edr incident-response kql kusto threat-hunting xdr
393
cyb3rmik3 / MDE-DFIR-Resources
A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.
curated-collections curated-list dfir digital-forensics digital-forensics-incident-response incident-response live-response mde microsoft microsoft-defender-for-endpoint resources kql kusto kusto-query kusto-query-language
252
ashwin-patil / blue-teaming-with-kql
Repository with Sample KQL Query examples for Threat Hunting
threat-hunting blueteaming azure-data-explorer azure-sentinel kql security siem loganalytics azure
192
wortell / KQL
KQL queries for Advanced Hunting
kql security hunting
165
getkirby / kql
Kirby's Query Language API combines the flexibility of Kirby's data structures, the power of GraphQL and the simplicity of REST.
kirby cms api query flat-file file-based headless-cms query-language json kql
Language:PHP 140
lawndoc / AdvancedHuntingQueries
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant
security cybersecurity kusto kql hunting threat-hunting detection detection-engineering microsoft microsoft365 defender-for-endpoint defender defender-atp cyber-security xdr
94
ep3p / Sentinel_KQL
In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).
microsoft security azure kql watchlist kusto sentinel siem entra entra-id microsoft-sentinel
91
tobiasmcvey / kusto-queries
example queries for learning the kusto language
kusto-language kql kusto azure application-insights
84
alexverboon / Hunting-Queries-Detection-Rules
KQL Queries. Microsoft 365 Defender, Microsoft Sentinel
azure azuread defender365 defenderforendpoint defenderforidentity detection dfir hunting kql security sentinel
66
jischell-msft / RemoteManagementMonitoringTools
Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
defender-for-endpoint kql mde security threat-hunting remotemanagement rmm
Language:PowerShell 62
globalbao / azure-resource-graph
Collection of Azure Resource Graph queries for use in Portal and via PowerShell - by @JesseLoudon
azgraph azure azure-resource-graph kql kusto-language resource-graph
56
f-bader / AzSentinelQueries
Repository with Sentinel Analytics Rules and Hunting Queries
analytic-rules detections hacktoberfest kql kusto sentinel threat-hunting
53
cylaris / awesomekql
Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs
azure detection detection-rules kql siem
42
EEN421 / KQL-Queries
Ian Hanley's deceptively simple KQL queries.
azure cloud-security cybersecurity devsecops kql microsoft-sentinel
39
Azure / pykusto
Query Kusto like a pro from the comfort of your Jupyter notebook
kusto azure-data-explorer query-builder kql analytics jupyter-notebook
Language:Python 30
noodlemctwoodle / pf-azure-sentinel
Parse pfSense/OPNSense logs using Logstash, GeoIP tag entities, add additional context to logs, then send to Azure Sentinel for analysis.
azure-sentinel pfsense-logs geoip logstash parse pfsense maxmind maxmind-geoip firewall-logs visualization opnsense opnsense-firewall pfsense-firewall opnsense-logs monitor kql linux-oms sentinel sentinel-dashboard analytics
28
ugurkocde / KQL-Search
azure intune kql security
Language:JavaScript 25
davidnx / baby-kusto-csharp
A self-contained execution engine for the Kusto Query Language (KQL) written in C#
kusto azure-data-explorer data-science kql
Language:C# 22
f-mahler / vuekit
Kirby 3 + Vue.js kit
vuejs kirby kirby3 kirby-cms boilerplate template kql
Language:PHP 18
squaredup / samples
A collection of sample dashboards, custom labels, mustaches, SQL scripts and PowerShell scripts to help you get the most out of SquaredUp. #community-powered
powershell-scripts mustache dashboards sql-scripts squaredup community-answers kql kusto json powershell dashboard samples
Language:PowerShell 18
microsoft / Fabric-RTA-FlightStream
Microsoft Fabric Real-time Analytics flight streaming
etl kql lakehouse powerbi pyspark-notebook streaming
Language:Jupyter Notebook 14
jostuffl / AzureSentinel_Stuff
A collection of things I've created or found that I think is useful for Azure Sentinel.
azure sentinel notebooks-jupyter kql azure-sentinel
Language:Jupyter Notebook 12
pthoor / KustoDetectiveAgencyHints
Hints for the Kusto Detective Agency
azure kql kusto
12
kusto.blog
y0nil / kusto.blog
A technical blog about Kusto
kusto azure-data-explorer kql azure bigdata big-data-analytics big-data-platform blog kusto-query-language kusto-language azure-sentinel azure-monitor
Language:HTML 11
stuymedova / kirby-sveltekit
[SETUP] SvelteKit frontend for Kirby CMS + KQL backend
sveltekit svelte kirby kirby3 kirby-cms kirby3-cms kql
Language:JavaScript 9
0xbythesecond / Azure-SOC-Honeynet-Project
Built a mini HoneyNet in Azure and ingest log sources from various resources into a Log Analytics workspace
azure honeynet log-analytics-workspace network-security-groups sentinel kql nist800-53 powershell securityalert securityevent syslog azurenetworkanalytics nist800-61 azure-virtual-networks security-operations-center soc-analyst
6
austin-lai / Collection-of-Azure-Monitor-or-Sentinel-Kusto-Queries
Collection of Azure Monitor or Sentinel Kusto Queries
azure-log-analytics azure-monitor azure-sentinel kql security kusto-query
6
b4fun / ku
Toolkit for collecting and exploring logs using pipelined query lanaguage and sqlite.
kql kusto logging pipelined prql sqlite
Language:TypeScript 6
gh-andrem / DefenderXDR-AdvancedHunting
Defender XDR Advanced Hunting Queries (MDE, MDAV, Device Discovery)
advanced-hunting defender-for-endpoint defender-xdr kql m365-defender
Language:PowerShell 6
xFFninja / happy_threat_hunting
Threat Hunting
detection kql siem sigma-rules threathunting
6

kql

netevert / sentinel-attack

Bert-JanP / Hunting-Queries-Detection-Rules

FalconForceTeam / FalconFriday

Cyb3r-Monk / Threat-Hunting-and-Detection

alexverboon / MDATP

cyb3rmik3 / KQL-threat-hunting-queries

LearningKijo / KQL

cyb3rmik3 / MDE-DFIR-Resources

ashwin-patil / blue-teaming-with-kql

wortell / KQL

getkirby / kql

lawndoc / AdvancedHuntingQueries

ep3p / Sentinel_KQL

tobiasmcvey / kusto-queries

alexverboon / Hunting-Queries-Detection-Rules

jischell-msft / RemoteManagementMonitoringTools

globalbao / azure-resource-graph

f-bader / AzSentinelQueries

cylaris / awesomekql

EEN421 / KQL-Queries

Azure / pykusto

noodlemctwoodle / pf-azure-sentinel

ugurkocde / KQL-Search

davidnx / baby-kusto-csharp

f-mahler / vuekit

squaredup / samples

microsoft / Fabric-RTA-FlightStream

jostuffl / AzureSentinel_Stuff

pthoor / KustoDetectiveAgencyHints

y0nil / kusto.blog

stuymedova / kirby-sveltekit

0xbythesecond / Azure-SOC-Honeynet-Project

austin-lai / Collection-of-Azure-Monitor-or-Sentinel-Kusto-Queries

b4fun / ku

gh-andrem / DefenderXDR-AdvancedHunting

xFFninja / happy_threat_hunting