Hunting-Queries-Detection-Rules
kusto-queries
Our great sponsors
| Hunting-Queries-Detection-Rules | kusto-queries | |
|---|---|---|
| 7 | 1 | |
| 997 | 84 | |
| - | - | |
| 9.3 | 0.0 | |
| 4 days ago | almost 3 years ago | |
| Python | ||
| BSD 3-clause "New" or "Revised" License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Hunting-Queries-Detection-Rules
- Advanced Hunting queries every admin should use
- Hunting Querie into a Detection rule
- MS Sentinel Analytics & KQL
- Analytical rules
- MDE Repointing Frequency
-
Least occurrence in MDE
This will be the query that you are looking for. I do have a lot more queries if you are interested: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules
- Must have analytic rules
kusto-queries
-
I am a software geek in Cloud Security, reducing risk @ exascale. AMA!
Unfortunately I'm not familiar with Kusto, but I phoned a friend and got this which they said was "helpful" - https://github.com/tobiasmcvey/kusto-queries/blob/main/README.md
What are some alternatives?
Microsoft-365-Defender-Hunting-Queries - Sample queries for Advanced hunting in Microsoft 365 Defender
azure-service-bus - ☁️ Azure Service Bus service issue tracking and samples
chatgpt-raycast - ChatGPT raycast extension
azure-kusto-spark - Apache Spark Connector for Azure Kusto
Sentinel-Queries - Collection of KQL queries
ApplicationInsights-dotnet - ApplicationInsights-dotnet
AzureHunter - A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
learning-cloud - Courses, sample code, articles & screencasts - AWS, Azure, & GCP
Linux Security - Ways to attack and protect Linux 🧢
ApplicationInsights-node.js - Microsoft Application Insights SDK for Node.js
KQL - Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
awesomekql - Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs