Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules. (by Bert-JanP)
Sentinel-Queries
Collection of KQL queries (by reprise99)
Our great sponsors
| Hunting-Queries-Detection-Rules | Sentinel-Queries | |
|---|---|---|
| 7 | 17 | |
| 997 | 1,289 | |
| - | - | |
| 9.3 | 7.4 | |
| 5 days ago | 25 days ago | |
| Python | ||
| BSD 3-clause "New" or "Revised" License | MIT License |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Hunting-Queries-Detection-Rules
Posts with mentions or reviews of Hunting-Queries-Detection-Rules.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-12-11.
- Advanced Hunting queries every admin should use
- Hunting Querie into a Detection rule
- MS Sentinel Analytics & KQL
- Analytical rules
- MDE Repointing Frequency
-
Least occurrence in MDE
This will be the query that you are looking for. I do have a lot more queries if you are interested: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules
- Must have analytic rules
Sentinel-Queries
Posts with mentions or reviews of Sentinel-Queries.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-12-11.
-
Custom Detections
Matt Zorich has a good list of detections for both M365D and Sentinel - https://github.com/reprise99/Sentinel-Queries
-
What were your "HOLY SH*T IT'S REALLY THAT SIMPLE?!" moments when working through issues and finding a solution? Share so that others may learn.
Here's a massive list of pre-built queries to get you started: GitHub - reprise99/Sentinel-Queries: Collection of KQL queries
- MS Sentinel Analytics & KQL
- Analytical rules
- Useful Collection of KQL queries
- BARK Detections: These KQL queries are designed to find use of the abuses in the BloodHound BARK toolkit in your Azure AD tenant. These queries are not designed to detect the use of BARK itself, just the behaviour that BARK simulates.
-
What are best best advanced hunting queries you use in 365 defender?
https://github.com/reprise99/Sentinel-Queries has a number
- Must have analytic rules
- Sentinel KQL Query: Create a pivot table showing all conditional access policy outcomes over the last 30 days
- Sentinel KQL Query: Summarize outbound (your users connecting to other tenants) activity by listing the users and which applications they are accessing in each remote tenant
What are some alternatives?
When comparing Hunting-Queries-Detection-Rules and Sentinel-Queries you can also consider the following projects:
Microsoft-365-Defender-Hunting-Queries - Sample queries for Advanced hunting in Microsoft 365 Defender
chatgpt-raycast - ChatGPT raycast extension
kusto-queries - example queries for learning the kusto language
awesome-kql-sentinel - A curated list of blogs, videos, tutorials, queries and anything else valuable to help you learn and master KQL and Microsoft Sentinel
AzureHunter - A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
WindowsDefenderATP-Hunting-Queries - Sample queries for Advanced hunting in Microsoft Defender ATP
Linux Security - Ways to attack and protect Linux 🧢
FalconFriday - Hunting queries and detections
KQL - Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
modelfirst - Draw Data Model Schema and generate code
Hunting-Queries-Detection-Rules vs Microsoft-365-Defender-Hunting-Queries
Sentinel-Queries vs chatgpt-raycast
Hunting-Queries-Detection-Rules vs chatgpt-raycast
Sentinel-Queries vs Microsoft-365-Defender-Hunting-Queries
Hunting-Queries-Detection-Rules vs kusto-queries
Sentinel-Queries vs awesome-kql-sentinel
Hunting-Queries-Detection-Rules vs AzureHunter
Sentinel-Queries vs WindowsDefenderATP-Hunting-Queries
Hunting-Queries-Detection-Rules vs Linux Security
Sentinel-Queries vs FalconFriday
Hunting-Queries-Detection-Rules vs KQL
Hunting-Queries-Detection-Rules vs modelfirst