SentinelKQL

This section is dedicated to KQL queries that I've developed at customer request.

Name		Name	Last commit message	Last commit date
Latest commit History 475 Commits
Images		Images
LabKQL		LabKQL
MenuBlade		MenuBlade
Overview_Page		Overview_Page
URLDetonation		URLDetonation
AMAAgent.txt		AMAAgent.txt
AR-BreakGlassAccount.txt		AR-BreakGlassAccount.txt
AR-BruteForce.txt		AR-BruteForce.txt
AR-CloudShellExecution.txt		AR-CloudShellExecution.txt
AR-NSGChanges		AR-NSGChanges
ARPPoisoning.txt		ARPPoisoning.txt
ASCIncidentClosure.txt		ASCIncidentClosure.txt
AZCopy.yaml		AZCopy.yaml
Account-Created-Addedto-LocalAdministrator.txt		Account-Created-Addedto-LocalAdministrator.txt
ActiveIncidents.txt		ActiveIncidents.txt
ActiveUsers.txt		ActiveUsers.txt
ActivityFromInfrequentCountry.txt		ActivityFromInfrequentCountry.txt
AddClientDataSource.txt		AddClientDataSource.txt
AddedorAssignedGlobalAdministratorroleperms.txt		AddedorAssignedGlobalAdministratorroleperms.txt
AdminConsent.txt		AdminConsent.txt
AgentInfowithLocation.txt		AgentInfowithLocation.txt
AgentProblems.txt		AgentProblems.txt
AgentedDevicesnotADJoined.txt		AgentedDevicesnotADJoined.txt
AlertContextParser.txt		AlertContextParser.txt
AlertIngestionTime.txt		AlertIngestionTime.txt
AlertProviderCounts.txt		AlertProviderCounts.txt
All_IPs_SecurityAlerts.yaml		All_IPs_SecurityAlerts.yaml
Allexes.txt		Allexes.txt
AnalyticsRuleCreatedorModified.txt		AnalyticsRuleCreatedorModified.txt
AnalyticsRuleCreatedorModifiedwithDisplayName.txt		AnalyticsRuleCreatedorModifiedwithDisplayName.txt
AnalyticsRuleDeleted.txt		AnalyticsRuleDeleted.txt
AnalyticsRuleLastRun.txt		AnalyticsRuleLastRun.txt
AnalyticsRulesRunbyTimes.txt		AnalyticsRulesRunbyTimes.txt
AnomalousAADAccountCreation.txt		AnomalousAADAccountCreation.txt
AnomalousToken.txt		AnomalousToken.txt
AutomationRuleCreation.yaml		AutomationRuleCreation.yaml
AutomationRuleDelete.txt		AutomationRuleDelete.txt
AutomationRuleHasRun.txt		AutomationRuleHasRun.txt
Azure Runbooks query with correlation.txt		Azure Runbooks query with correlation.txt
AzurePortalLoginErrors.txt		AzurePortalLoginErrors.txt
BillableDatabyDataType.txt		BillableDatabyDataType.txt
Billabledatavolumebydatatype.txt		Billabledatavolumebydatatype.txt
Billabledatavolumebysolution.txt		Billabledatavolumebysolution.txt
BitLockerMaliciousEncrypt.txt		BitLockerMaliciousEncrypt.txt
BookMarkUpdatedBy.txt		BookMarkUpdatedBy.txt
BookmarkUpdate.txt		BookmarkUpdate.txt
BookmarksCreatedBy.txt		BookmarksCreatedBy.txt
BrowserActivitybyGEO.txt		BrowserActivitybyGEO.txt
BuiltInFusionCreation.txt		BuiltInFusionCreation.txt
CEFDevices.txt		CEFDevices.txt
CVE-2023-23397-Detection.kql		CVE-2023-23397-Detection.kql
CalculateSumofColumn.txt		CalculateSumofColumn.txt
CaseComments.txt		CaseComments.txt
Check4LockedoutUser.txt		Check4LockedoutUser.txt
CheckPointLogs.txt		CheckPointLogs.txt
CloudShell.txt		CloudShell.txt
CloudShellPart2.txt		CloudShellPart2.txt
Cloudshell2.txt		Cloudshell2.txt
CommentDeleted.txt		CommentDeleted.txt
CommonSecurityLogCostsbyVendor.txt		CommonSecurityLogCostsbyVendor.txt
CommonSecurityLogThroughput.txt		CommonSecurityLogThroughput.txt
CompareTotalRecordswithValuebyPercentage.txt		CompareTotalRecordswithValuebyPercentage.txt
Conditional access changes new value and old value.txt		Conditional access changes new value and old value.txt
ConnectorFailures.kql		ConnectorFailures.kql
CostPerSubscription.txt		CostPerSubscription.txt
CostperEventID.txt		CostperEventID.txt
CountriesWhereAgentedComputersReportFrom.txt		CountriesWhereAgentedComputersReportFrom.txt
Cross resource query.txt		Cross resource query.txt
DNSActivity_Attempts_Per_Device.txt		DNSActivity_Attempts_Per_Device.txt
DarkSideRansomware.txt		DarkSideRansomware.txt
DataByProvider.txt		DataByProvider.txt
DataConnectorOpened.txt		DataConnectorOpened.txt
DataConnectorReqsFailed.txt		DataConnectorReqsFailed.txt
DataConnectorReqsFailedbyCallerIPOperation.txt		DataConnectorReqsFailedbyCallerIPOperation.txt
DataIngestEstimation.txt		DataIngestEstimation.txt
DataIngestionNotHappening.txt		DataIngestionNotHappening.txt
DataPerComputer.txt		DataPerComputer.txt
DataPerSyslogServer.txt		DataPerSyslogServer.txt
DataRetentionChanges.txt		DataRetentionChanges.txt
DataTypeUsagePieChart.txt		DataTypeUsagePieChart.txt
DayofWeek.txt		DayofWeek.txt
Debugging authentication sign-ins.txt		Debugging authentication sign-ins.txt
DefenderAVNotSuccessful.txt		DefenderAVNotSuccessful.txt
DefenderExclusions.txt		DefenderExclusions.txt
DefenderLiveResponse.txt		DefenderLiveResponse.txt
DeviceStopsReporting.txt		DeviceStopsReporting.txt
DirectAgent.txt		DirectAgent.txt
DirectReport.txt		DirectReport.txt
Does a table exist.txt		Does a table exist.txt
DomainAdminsEnterpriseAdmins.txt		DomainAdminsEnterpriseAdmins.txt
DormantAccounts.txt		DormantAccounts.txt
Duration of session.txt		Duration of session.txt
EPSforM365AdvancedTables.txt		EPSforM365AdvancedTables.txt
EPSperTable.kql		EPSperTable.kql
EmailForwarding.txt		EmailForwarding.txt
EventIDStorageinBytes.txt		EventIDStorageinBytes.txt
EventIDsinLastDay.txt		EventIDsinLastDay.txt
EventLogSources.txt		EventLogSources.txt
EventVolumePerTable.txt		EventVolumePerTable.txt
ExecutedProcesses.txt		ExecutedProcesses.txt

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Repository files navigation

SentinelKQL

About

Uh oh!

Releases

Packages

AnthonyZhuk/SentinelKQL

Folders and files

Latest commit

History

Repository files navigation

SentinelKQL

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Packages