{"repo":"ep3p/Sentinel_KQL","free":true,"listed":false,"github":"https://github.com/ep3p/Sentinel_KQL","clone":"git clone https://github.com/ep3p/Sentinel_KQL.git","description":"In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).","language":"XSLT","stars":143,"topics":["microsoft","security","azure","kql","watchlist","kusto","sentinel","siem","entra","entra-id"],"license":"MIT","category":"security-tools","readme_excerpt":"Sentinel KQL In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool). You could check other resources like: GitHub ---- reprise99/awesome-kql-sentinel (start here) reprise99/Sentinel-Queries rod-trent/SentinelKQL FalconForceTeam/FalconFriday Cyb3r-Monk/Threat-Hunting-and-Detection Bert-JanP/Hunting-Queries-Detection-Rules alexverboon/Azure-Threat-Research-Matrix-KQL eshlomo1/Microsoft-Sentinel-4-SecOps Kaidja/Azure-Sentinel samilamppu/Sentinel-queries ashwin-patil/blue-teaming-with-kql le0li9ht/Microsoft-Sentinel-Queries DanielChronlund/DCSecurityOperations ugurkocde/KQL Intune ... Other links: Tags Link ---- ---- [KQL] Kusto Query Language (KQL) Shortcuts Kusto Query Language (KQL) Regular Expressions Library KQL Queries Aggregator [Solutions] oshezaf - Sentinel Solutions Analyzer [Data sources] sreedharande/IngestOffice365AuditLogs techcommunity.microsoft.com External Data Sources in Sentinel Threat Indicator MISP [Rules] Microsoft Sentinel Analytics Rules Browser garybushey.com Markdown in Analytics Rules description medium.com/@tokesisr Mitigate High Ingestion times [Playbooks] Azure Logic Apps functions reference Incident Response Playbooks adr.iaan.be Query LogAnalytics from Logic App adr.iaan.be Forward Directory Activity Logs User Access Administrator Accelerynt-Security/AS-IP-Blocklist Logic App IP Address Alert to Conditional Access Accelerynt-Security/AS-Teams-Integration ","default_branch":null,"files":null,"tree":[],"storefront":"/r/ep3p","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/ep3p/Sentinel_KQL/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}