Skip to content

rod-trent/SentinelKQL

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

517 Commits
Ignite
Ignite
 
 
Images
Images
 
 
LabKQL
LabKQL
 
 
MenuBlade
MenuBlade
 
 
Overview_Page
Overview_Page
 
 
URLDetonation
URLDetonation
 
 
AMAAgent.kql
AMAAgent.kql
 
 
AR-BreakGlassAccount.kql
AR-BreakGlassAccount.kql
 
 
AR-BruteForce.kql
AR-BruteForce.kql
 
 
AR-CloudShellExecution.kql
AR-CloudShellExecution.kql
 
 
AR-NSGChanges.kql
AR-NSGChanges.kql
 
 
ARPPoisoning.txt
ARPPoisoning.txt
 
 
ASCIncidentClosure.txt
ASCIncidentClosure.txt
 
 
AZCopy.yaml
AZCopy.yaml
 
 
Account-Created-Addedto-LocalAdministrator.txt
Account-Created-Addedto-LocalAdministrator.txt
 
 
ActiveIncidents.txt
ActiveIncidents.txt
 
 
ActiveUsers.txt
ActiveUsers.txt
 
 
ActivityFromInfrequentCountry.txt
ActivityFromInfrequentCountry.txt
 
 
Activity_Increase_by_date.kql
Activity_Increase_by_date.kql
 
 
AddClientDataSource.txt
AddClientDataSource.txt
 
 
AddedorAssignedGlobalAdministratorroleperms.txt
AddedorAssignedGlobalAdministratorroleperms.txt
 
 
AdminConsent.txt
AdminConsent.txt
 
 
AgentInfowithLocation.txt
AgentInfowithLocation.txt
 
 
AgentProblems.txt
AgentProblems.txt
 
 
AgentedDevicesnotADJoined.txt
AgentedDevicesnotADJoined.txt
 
 
AlertContextParser.txt
AlertContextParser.txt
 
 
AlertIngestionTime.txt
AlertIngestionTime.txt
 
 
AlertProviderCounts.txt
AlertProviderCounts.txt
 
 
All_IPs_SecurityAlerts.yaml
All_IPs_SecurityAlerts.yaml
 
 
Allexes.txt
Allexes.txt
 
 
AnalyticsRuleCreatedorModified.txt
AnalyticsRuleCreatedorModified.txt
 
 
AnalyticsRuleCreatedorModifiedwithDisplayName.txt
AnalyticsRuleCreatedorModifiedwithDisplayName.txt
 
 
AnalyticsRuleDeleted.txt
AnalyticsRuleDeleted.txt
 
 
AnalyticsRuleLastRun.txt
AnalyticsRuleLastRun.txt
 
 
AnalyticsRulesRunbyTimes.txt
AnalyticsRulesRunbyTimes.txt
 
 
AnomalousAADAccountCreation.txt
AnomalousAADAccountCreation.txt
 
 
AnomalousToken.txt
AnomalousToken.txt
 
 
AutomationRuleCreation.yaml
AutomationRuleCreation.yaml
 
 
AutomationRuleDelete.txt
AutomationRuleDelete.txt
 
 
AutomationRuleHasRun.txt
AutomationRuleHasRun.txt
 
 
Azure Runbooks query with correlation.txt
Azure Runbooks query with correlation.txt
 
 
AzurePortalLoginErrors.txt
AzurePortalLoginErrors.txt
 
 
AzureServiceIPs.kql
AzureServiceIPs.kql
 
 
BillableDatabyDataType.txt
BillableDatabyDataType.txt
 
 
Billabledatavolumebydatatype.txt
Billabledatavolumebydatatype.txt
 
 
Billabledatavolumebysolution.txt
Billabledatavolumebysolution.txt
 
 
BitLockerMaliciousEncrypt.txt
BitLockerMaliciousEncrypt.txt
 
 
BookMarkUpdatedBy.txt
BookMarkUpdatedBy.txt
 
 
BookmarkUpdate.txt
BookmarkUpdate.txt
 
 
BookmarksCreatedBy.txt
BookmarksCreatedBy.txt
 
 
BrowserActivitybyGEO.txt
BrowserActivitybyGEO.txt
 
 
BuiltInFusionCreation.txt
BuiltInFusionCreation.txt
 
 
CEFDevices.txt
CEFDevices.txt
 
 
CVE-2023-23397-Detection.kql
CVE-2023-23397-Detection.kql
 
 
CalculateSumofColumn.txt
CalculateSumofColumn.txt
 
 
CaseComments.txt
CaseComments.txt
 
 
Check4LockedoutUser.txt
Check4LockedoutUser.txt
 
 
CheckPointLogs.txt
CheckPointLogs.txt
 
 
CloudShell.txt
CloudShell.txt
 
 
CloudShellPart2.txt
CloudShellPart2.txt
 
 
Cloudshell2.txt
Cloudshell2.txt
 
 
CommentDeleted.txt
CommentDeleted.txt
 
 
CommonSecurityLogCostsbyVendor.txt
CommonSecurityLogCostsbyVendor.txt
 
 
CommonSecurityLogThroughput.txt
CommonSecurityLogThroughput.txt
 
 
CompareTotalRecordswithValuebyPercentage.txt
CompareTotalRecordswithValuebyPercentage.txt
 
 
Conditional access changes new value and old value.txt
Conditional access changes new value and old value.txt
 
 
ConnectorFailures.kql
ConnectorFailures.kql
 
 
CostPerSubscription.txt
CostPerSubscription.txt
 
 
CostperEventID.txt
CostperEventID.txt
 
 
CountriesWhereAgentedComputersReportFrom.txt
CountriesWhereAgentedComputersReportFrom.txt
 
 
CountryInfoExternal.kql
CountryInfoExternal.kql
 
 
CreateAndQuery.kql
CreateAndQuery.kql
 
 
Cross resource query.txt
Cross resource query.txt
 
 
DNSActivity_Attempts_Per_Device.txt
DNSActivity_Attempts_Per_Device.txt
 
 
DarkSideRansomware.txt
DarkSideRansomware.txt
 
 
DataByProvider.txt
DataByProvider.txt
 
 
DataConnectorOpened.txt
DataConnectorOpened.txt
 
 
DataConnectorReqsFailed.txt
DataConnectorReqsFailed.txt
 
 
DataConnectorReqsFailedbyCallerIPOperation.txt
DataConnectorReqsFailedbyCallerIPOperation.txt
 
 
DataIngestEstimation.txt
DataIngestEstimation.txt
 
 
DataIngestionNotHappening.txt
DataIngestionNotHappening.txt
 
 
DataPerComputer.kql
DataPerComputer.kql
 
 
DataPerSyslogServer.txt
DataPerSyslogServer.txt
 
 
DataRetentionChanges.txt
DataRetentionChanges.txt
 
 
DataTypeUsagePieChart.txt
DataTypeUsagePieChart.txt
 
 
DayofWeek.txt
DayofWeek.txt
 
 
Debugging authentication sign-ins.txt
Debugging authentication sign-ins.txt
 
 
DefenderAVNotSuccessful.txt
DefenderAVNotSuccessful.txt
 
 
DefenderExclusions.txt
DefenderExclusions.txt
 
 
DefenderLiveResponse.txt
DefenderLiveResponse.txt
 
 
Defender_Tampering.kql
Defender_Tampering.kql
 
 
DeviceStopsReporting.txt
DeviceStopsReporting.txt
 
 
DirectAgent.kql
DirectAgent.kql
 
 
DirectReport.txt
DirectReport.txt
 
 
Does a table exist.txt
Does a table exist.txt
 
 
DomainAdminsEnterpriseAdmins.txt
DomainAdminsEnterpriseAdmins.txt
 
 
DormantAccounts.txt
DormantAccounts.txt
 
 
Duration of session.txt
Duration of session.txt
 
 
EPSforM365AdvancedTables.txt
EPSforM365AdvancedTables.txt
 
 
EPSperTable.kql
EPSperTable.kql
 
 

Repository files navigation

SentinelKQL

This section is dedicated to KQL queries that I've developed at customer request.

About

Azure Sentinel KQL

Resources

Readme
Activity

Stars

471 stars

Watchers

41 watching

Forks

114 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors