KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
-
Updated
Jun 9, 2024 - Python
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
Hunting queries and detections
Microsoft Defender XDR - Resource Hub
Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant
Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
Python for Security is the home of all open source Python projects that can integrate with Microsoft Technologies.
This repository will describe the details surrounding the SIEM (wazuh) mini project, which will cover all aspects of topology design, deployment, rules, integration, and fine tune.
ASR Configurator, Essentials and Atomic Testing
Microsoft Defender for Endpoint PowerShell module
Microsoft Intune Custom Compliance
Repo includes KQL queries that you can run in your Azure Log Analyics environment.
A PowerShell module to interact with Microsoft's Defender for Endpoint API.
Custom made Query which you can run in your Microsoft Defender - Advanced Hunting tool to look for network activity related to Egregor Ransomware.
K9-Defender is highly Simple with a Sophisticated Watchdog System and a Powerful Process Scanning both for Windows 10 and 11
IOC Generator for Microsoft Defender for Endpoints
Config files for my GitHub profile.
Defender for Endpoint Advanced Hunting Queries
Experimental infrastructure and concepts for Azure Defender for Cloud
Logic App with Azure Durable Functions
Add a description, image, and links to the defender-for-endpoint topic page so that developers can more easily learn about it.
To associate your repository with the defender-for-endpoint topic, visit your repo's landing page and select "manage topics."