Skip to content
BranchesTags
 
 

Latest commit

 

History

320 Commits

Folders and files

NameName
Last commit message
Last commit date
AMAAgent.txt
AMAAgent.txt
 
 
AR-BreakGlassAccount.txt
AR-BreakGlassAccount.txt
 
 
AR-BruteForce.txt
AR-BruteForce.txt
 
 
AR-CloudShellExecution.txt
AR-CloudShellExecution.txt
 
 
AR-NSGChanges
AR-NSGChanges
 
 
ARPPoisoning.txt
ARPPoisoning.txt
 
 
ASCIncidentClosure.txt
ASCIncidentClosure.txt
 
 
AZCopy.yaml
AZCopy.yaml
 
 
Account-Created-Addedto-LocalAdministrator.txt
Account-Created-Addedto-LocalAdministrator.txt
 
 
ActiveIncidents.txt
ActiveIncidents.txt
 
 
AddClientDataSource.txt
AddClientDataSource.txt
 
 
AddedorAssignedGlobalAdministratorroleperms.txt
AddedorAssignedGlobalAdministratorroleperms.txt
 
 
AdminConsent.txt
AdminConsent.txt
 
 
AgentInfowithLocation.txt
AgentInfowithLocation.txt
 
 
AgentProblems.txt
AgentProblems.txt
 
 
AgentedDevicesnotADJoined.txt
AgentedDevicesnotADJoined.txt
 
 
AlertContextParser.txt
AlertContextParser.txt
 
 
AlertIngestionTime.txt
AlertIngestionTime.txt
 
 
AlertProviderCounts.txt
AlertProviderCounts.txt
 
 
All_IPs_SecurityAlerts.yaml
All_IPs_SecurityAlerts.yaml
 
 
AnalyticsRuleCreatedorModified.txt
AnalyticsRuleCreatedorModified.txt
 
 
AnalyticsRuleCreatedorModifiedwithDisplayName.txt
AnalyticsRuleCreatedorModifiedwithDisplayName.txt
 
 
AnalyticsRuleDeleted.txt
AnalyticsRuleDeleted.txt
 
 
AnalyticsRulesRunbyTimes.txt
AnalyticsRulesRunbyTimes.txt
 
 
AnomalousToken.txt
AnomalousToken.txt
 
 
AutomationRuleCreation.yaml
AutomationRuleCreation.yaml
 
 
Azure Runbooks query with correlation.txt
Azure Runbooks query with correlation.txt
 
 
AzurePortalLoginErrors.txt
AzurePortalLoginErrors.txt
 
 
BillableDatabyDataType.txt
BillableDatabyDataType.txt
 
 
Billabledatavolumebydatatype.txt
Billabledatavolumebydatatype.txt
 
 
Billabledatavolumebysolution.txt
Billabledatavolumebysolution.txt
 
 
BitLockerMaliciousEncrypt.txt
BitLockerMaliciousEncrypt.txt
 
 
BookMarkUpdatedBy.txt
BookMarkUpdatedBy.txt
 
 
BookmarkUpdate.txt
BookmarkUpdate.txt
 
 
BookmarksCreatedBy.txt
BookmarksCreatedBy.txt
 
 
BrowserActivitybyGEO.txt
BrowserActivitybyGEO.txt
 
 
BuiltInFusionCreation.txt
BuiltInFusionCreation.txt
 
 
CEFDevices.txt
CEFDevices.txt
 
 
CaseComments.txt
CaseComments.txt
 
 
Check4LockedoutUser.txt
Check4LockedoutUser.txt
 
 
CheckPointLogs.txt
CheckPointLogs.txt
 
 
CloudShell.txt
CloudShell.txt
 
 
CloudShellPart2.txt
CloudShellPart2.txt
 
 
Cloudshell2.txt
Cloudshell2.txt
 
 
CommentDeleted.txt
CommentDeleted.txt
 
 
CommonSecurityLogCostsbyVendor.txt
CommonSecurityLogCostsbyVendor.txt
 
 
CommonSecurityLogThroughput.txt
CommonSecurityLogThroughput.txt
 
 
CompareTotalRecordswithValuebyPercentage.txt
CompareTotalRecordswithValuebyPercentage.txt
 
 
Conditional access changes new value and old value.txt
Conditional access changes new value and old value.txt
 
 
CostPerSubscription.txt
CostPerSubscription.txt
 
 
CostperEventID.txt
CostperEventID.txt
 
 
CountriesWhereAgentedComputersReportFrom.txt
CountriesWhereAgentedComputersReportFrom.txt
 
 
Cross resource query.txt
Cross resource query.txt
 
 
DNSActivity_Attempts_Per_Device.txt
DNSActivity_Attempts_Per_Device.txt
 
 
DarkSideRansomware.txt
DarkSideRansomware.txt
 
 
DataByProvider.txt
DataByProvider.txt
 
 
DataConnectorOpened.txt
DataConnectorOpened.txt
 
 
DataConnectorReqsFailed.txt
DataConnectorReqsFailed.txt
 
 
DataConnectorReqsFailedbyCallerIPOperation.txt
DataConnectorReqsFailedbyCallerIPOperation.txt
 
 
DataIngestEstimation.txt
DataIngestEstimation.txt
 
 
DataIngestionNotHappening.txt
DataIngestionNotHappening.txt
 
 
DataPerComputer.txt
DataPerComputer.txt
 
 
DataPerSyslogServer.txt
DataPerSyslogServer.txt
 
 
DataRetentionChanges.txt
DataRetentionChanges.txt
 
 
DataTypeUsagePieChart.txt
DataTypeUsagePieChart.txt
 
 
Debugging authentication sign-ins.txt
Debugging authentication sign-ins.txt
 
 
DefenderExclusions.txt
DefenderExclusions.txt
 
 
DeviceStopsReporting.txt
DeviceStopsReporting.txt
 
 
DirectAgent.txt
DirectAgent.txt
 
 
DirectReport.txt
DirectReport.txt
 
 
Does a table exist.txt
Does a table exist.txt
 
 
DomainAdminsEnterpriseAdmins.txt
DomainAdminsEnterpriseAdmins.txt
 
 
DormantAccounts.txt
DormantAccounts.txt
 
 
Duration of session.txt
Duration of session.txt
 
 
EPSforM365AdvancedTables.txt
EPSforM365AdvancedTables.txt
 
 
EmailForwarding.txt
EmailForwarding.txt
 
 
EventIDStorageinBytes.txt
EventIDStorageinBytes.txt
 
 
EventIDsinLastDay.txt
EventIDsinLastDay.txt
 
 
EventLogSources.txt
EventLogSources.txt
 
 
EventVolumePerTable.txt
EventVolumePerTable.txt
 
 
ExecutedProcesses.txt
ExecutedProcesses.txt
 
 
ExistingConditionalAccessPolicies.txt
ExistingConditionalAccessPolicies.txt
 
 
ExpiredPassword.txt
ExpiredPassword.txt
 
 
ExternalAccess.txt
ExternalAccess.txt
 
 
ExternalGEOforSecurityEvents.txt
ExternalGEOforSecurityEvents.txt
 
 
FailedLoginsPerAccount.txt
FailedLoginsPerAccount.txt
 
 
FileExecutionOver5Times.txt
FileExecutionOver5Times.txt
 
 
GEOIPLocation.txt
GEOIPLocation.txt
 
 
GetTags.txt
GetTags.txt
 
 
Heartbeatnotreceivedinlast30min.txt
Heartbeatnotreceivedinlast30min.txt
 
 
HourMinute.txt
HourMinute.txt
 
 
HowManyAlertsGeneratedByService.txt
HowManyAlertsGeneratedByService.txt
 
 
HowManyHostLogons.txt
HowManyHostLogons.txt
 
 
HowManyQueriesEachPersonRan.txt
HowManyQueriesEachPersonRan.txt
 
 
HuntingBookmarkHealth.txt
HuntingBookmarkHealth.txt
 
 
HuntingQueriesAzureActivitySuccessandFailures.txt
HuntingQueriesAzureActivitySuccessandFailures.txt
 
 
ImpossibleTravelKQL.txt
ImpossibleTravelKQL.txt
 
 
ImpossibleTravelMCAS.txt
ImpossibleTravelMCAS.txt
 
 
IncidentOwnerChange.txt
IncidentOwnerChange.txt
 
 
Incidents.txt
Incidents.txt
 
 

Repository files navigation

SentinelKQL

This section is dedicated to KQL queries that I've developed at customer request.

About

Azure Sentinel KQL

Resources

Readme
Activity

Stars

2 stars

Watchers

0 watching

Forks

2 forks
Report repository

Releases

Packages

Contributors