Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality. Learn more →
Sentinel-Queries Alternatives
Similar projects and alternatives to Sentinel-Queries
-
Microsoft-365-Defender-Hunting-Queries
Discontinued Sample queries for Advanced hunting in Microsoft 365 Defender
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
-
Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
-
awesome-kql-sentinel
A curated list of blogs, videos, tutorials, queries and anything else valuable to help you learn and master KQL and Microsoft Sentinel
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
Sentinel-Queries reviews and mentions
-
Custom Detections
Matt Zorich has a good list of detections for both M365D and Sentinel - https://github.com/reprise99/Sentinel-Queries
-
What were your "HOLY SH*T IT'S REALLY THAT SIMPLE?!" moments when working through issues and finding a solution? Share so that others may learn.
Here's a massive list of pre-built queries to get you started: GitHub - reprise99/Sentinel-Queries: Collection of KQL queries
- MS Sentinel Analytics & KQL
- Analytical rules
- Useful Collection of KQL queries
- BARK Detections: These KQL queries are designed to find use of the abuses in the BloodHound BARK toolkit in your Azure AD tenant. These queries are not designed to detect the use of BARK itself, just the behaviour that BARK simulates.
-
What are best best advanced hunting queries you use in 365 defender?
https://github.com/reprise99/Sentinel-Queries has a number
- Must have analytic rules
- Sentinel KQL Query: Create a pivot table showing all conditional access policy outcomes over the last 30 days
- Sentinel KQL Query: Summarize outbound (your users connecting to other tenants) activity by listing the users and which applications they are accessing in each remote tenant
-
A note from our sponsor - InfluxDB
www.influxdata.com | 25 Apr 2024
Stats
reprise99/Sentinel-Queries is an open source project licensed under MIT License which is an OSI approved license.
Sponsored