Skip to content
BranchesTags
 
 

Latest commit

 

History

203 Commits

Folders and files

NameName
Last commit message
Last commit date
AR-BreakGlassAccount.txt
AR-BreakGlassAccount.txt
 
 
AR-BruteForce.txt
AR-BruteForce.txt
 
 
AR-CloudShellExecution.txt
AR-CloudShellExecution.txt
 
 
AR-NSGChanges
AR-NSGChanges
 
 
Account-Created-Addedto-LocalAdministrator.txt
Account-Created-Addedto-LocalAdministrator.txt
 
 
ActiveIncidents.txt
ActiveIncidents.txt
 
 
AddClientDataSource.txt
AddClientDataSource.txt
 
 
AddedorAssignedGlobalAdministratorroleperms.txt
AddedorAssignedGlobalAdministratorroleperms.txt
 
 
AdminConsent.txt
AdminConsent.txt
 
 
AgentProblems.txt
AgentProblems.txt
 
 
AgentedDevicesnotADJoined.txt
AgentedDevicesnotADJoined.txt
 
 
All_IPs_SecurityAlerts.yaml
All_IPs_SecurityAlerts.yaml
 
 
AnalyticsRuleCreatedorModified.txt
AnalyticsRuleCreatedorModified.txt
 
 
AnalyticsRuleDeleted.txt
AnalyticsRuleDeleted.txt
 
 
AnalyticsRulesRunbyTimes.txt
AnalyticsRulesRunbyTimes.txt
 
 
AutomationRuleCreation.yaml
AutomationRuleCreation.yaml
 
 
Azure Runbooks query with correlation.txt
Azure Runbooks query with correlation.txt
 
 
AzurePortalLoginErrors.txt
AzurePortalLoginErrors.txt
 
 
BillableDatabyDataType.txt
BillableDatabyDataType.txt
 
 
Billabledatavolumebydatatype.txt
Billabledatavolumebydatatype.txt
 
 
Billabledatavolumebysolution.txt
Billabledatavolumebysolution.txt
 
 
BookMarkUpdatedBy.txt
BookMarkUpdatedBy.txt
 
 
BookmarkUpdate.txt
BookmarkUpdate.txt
 
 
BookmarksCreatedBy.txt
BookmarksCreatedBy.txt
 
 
BrowserActivitybyGEO.txt
BrowserActivitybyGEO.txt
 
 
BuiltInFusionCreation.txt
BuiltInFusionCreation.txt
 
 
CEFDevices.txt
CEFDevices.txt
 
 
CaseComments.txt
CaseComments.txt
 
 
Check4LockedoutUser.txt
Check4LockedoutUser.txt
 
 
CheckPointLogs.txt
CheckPointLogs.txt
 
 
CloudShell.txt
CloudShell.txt
 
 
CloudShellPart2.txt
CloudShellPart2.txt
 
 
Cloudshell2.txt
Cloudshell2.txt
 
 
CompareTotalRecordswithValuebyPercentage.txt
CompareTotalRecordswithValuebyPercentage.txt
 
 
Conditional access changes new value and old value.txt
Conditional access changes new value and old value.txt
 
 
CostperEventID.txt
CostperEventID.txt
 
 
CountriesWhereAgentedComputersReportFrom.txt
CountriesWhereAgentedComputersReportFrom.txt
 
 
Cross resource query.txt
Cross resource query.txt
 
 
DataByProvider.txt
DataByProvider.txt
 
 
DataConnectorOpened.txt
DataConnectorOpened.txt
 
 
DataConnectorReqsFailed.txt
DataConnectorReqsFailed.txt
 
 
DataConnectorReqsFailedbyCallerIPOperation.txt
DataConnectorReqsFailedbyCallerIPOperation.txt
 
 
DataIngestionNotHappening.txt
DataIngestionNotHappening.txt
 
 
DataTypeUsagePieChart.txt
DataTypeUsagePieChart.txt
 
 
Debugging authentication sign-ins.txt
Debugging authentication sign-ins.txt
 
 
DirectAgent.txt
DirectAgent.txt
 
 
DirectReport.txt
DirectReport.txt
 
 
Does a table exist.txt
Does a table exist.txt
 
 
DomainAdminsEnterpriseAdmins.txt
DomainAdminsEnterpriseAdmins.txt
 
 
Duration of session.txt
Duration of session.txt
 
 
EventIDStorageinBytes.txt
EventIDStorageinBytes.txt
 
 
EventIDsinLastDay.txt
EventIDsinLastDay.txt
 
 
EventLogSources.txt
EventLogSources.txt
 
 
EventVolumePerTable.txt
EventVolumePerTable.txt
 
 
ExecutedProcesses.txt
ExecutedProcesses.txt
 
 
ExistingConditionalAccessPolicies.txt
ExistingConditionalAccessPolicies.txt
 
 
ExpiredPassword.txt
ExpiredPassword.txt
 
 
ExternalAccess.txt
ExternalAccess.txt
 
 
ExternalGEOforSecurityEvents.txt
ExternalGEOforSecurityEvents.txt
 
 
FileExecutionOver5Times.txt
FileExecutionOver5Times.txt
 
 
GEOIPLocation.txt
GEOIPLocation.txt
 
 
GetTags.txt
GetTags.txt
 
 
HowManyAlertsGeneratedByService.txt
HowManyAlertsGeneratedByService.txt
 
 
HowManyQueriesEachPersonRan.txt
HowManyQueriesEachPersonRan.txt
 
 
HuntingQueriesAzureActivitySuccessandFailures.txt
HuntingQueriesAzureActivitySuccessandFailures.txt
 
 
ImpossibleTravelKQL.txt
ImpossibleTravelKQL.txt
 
 
Incidents.txt
Incidents.txt
 
 
IncidentsBetweenTimeRange.yaml
IncidentsBetweenTimeRange.yaml
 
 
Intune-AutoPilotFailedEnrollment1Day.txt
Intune-AutoPilotFailedEnrollment1Day.txt
 
 
Intune-DeviceThreatLevelnotSecured.txt
Intune-DeviceThreatLevelnotSecured.txt
 
 
Intune-Enrollmentsabandonedbytheuser.txt
Intune-Enrollmentsabandonedbytheuser.txt
 
 
IntuneActivityTypes.txt
IntuneActivityTypes.txt
 
 
IntuneAuditEvents.txt
IntuneAuditEvents.txt
 
 
IntuneAuditEventsTrend.txt
IntuneAuditEventsTrend.txt
 
 
IntuneComplianceFailuresbyOperatingSystem.txt
IntuneComplianceFailuresbyOperatingSystem.txt
 
 
IntuneComplianceFailuresbyReason.txt
IntuneComplianceFailuresbyReason.txt
 
 
IntuneCountofSuccessfulEnrollmentsbyOS.txt
IntuneCountofSuccessfulEnrollmentsbyOS.txt
 
 
IntuneDevicesNotSupported.txt
IntuneDevicesNotSupported.txt
 
 
IntuneDevicesNotinCompliance.txt
IntuneDevicesNotinCompliance.txt
 
 
IntuneEnrollmentEventsTrend.txt
IntuneEnrollmentEventsTrend.txt
 
 
IntuneEnrollmentFailurereasons.txt
IntuneEnrollmentFailurereasons.txt
 
 
IntuneEnrollmentFailuresbyEnrollmentType.txt
IntuneEnrollmentFailuresbyEnrollmentType.txt
 
 
IntuneEnrollmentFailuresbyPlatform.txt
IntuneEnrollmentFailuresbyPlatform.txt
 
 
IntuneEnrollmentStatistics.txt
IntuneEnrollmentStatistics.txt
 
 
IntuneEnrollmentSuccessbyEnrollmentType.txt
IntuneEnrollmentSuccessbyEnrollmentType.txt
 
 
IntuneNotCompliant.txt
IntuneNotCompliant.txt
 
 
IntuneNotCompliant2.txt
IntuneNotCompliant2.txt
 
 
IntuneRecentEventsbyAccounts.txt
IntuneRecentEventsbyAccounts.txt
 
 
IntuneRemoteactionsbyactiontype.txt
IntuneRemoteactionsbyactiontype.txt
 
 
IntuneRemoteactionstopusers.txt
IntuneRemoteactionstopusers.txt
 
 
IntuneSuccessfulSynchedDevice.txt
IntuneSuccessfulSynchedDevice.txt
 
 
IntuneSummarizebyOperation.txt
IntuneSummarizebyOperation.txt
 
 
IntuneTopuserswithauditedactions.txt
IntuneTopuserswithauditedactions.txt
 
 
Intunecomputershutdowns.txt
Intunecomputershutdowns.txt
 
 
IntuneisCompliantByOSandOSVersion.txt
IntuneisCompliantByOSandOSVersion.txt
 
 
KDCforKRBTGTPassword.txt
KDCforKRBTGTPassword.txt
 
 
LAG analysis example.txt
LAG analysis example.txt
 
 
Language demo just for fun and demo pattern replace.txt
Language demo just for fun and demo pattern replace.txt
 
 
Latency for a Log Analytics example with rolling percentiles.txt
Latency for a Log Analytics example with rolling percentiles.txt
 
 
LineNumbers-serialize.txt
LineNumbers-serialize.txt
 
 

Repository files navigation

SentinelKQL

This section is dedicated to KQL queries that I've developed at customer request.

About

Azure Sentinel KQL

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors