Hunting-Queries-Detection-Rules

KQL Sentinel & Defender queries KQL for Defender XDR, Microsoft Sentinel & other Microsoft Solutions The purpose of this repository is to share KQL queries that can be used by anyone and are understandable. These queries are intended to increase detection coverage through the logs of Microsoft...

Azure-Sentinel

Microsoft Sentinel and Microsoft 365 Defender Welcome to the unified Microsoft Sentinel and Microsoft 365 Defender repository! This repository contains out of the box detections, exploration queries, hunting queries, workbooks, playbooks and much more to help you get ramped up with Microsoft...

ClientInspectorV2

Introduction to ClientInspector v2 Are you in control? - or are some of your core infrastructure processes like patching, antivirus, bitlocker enablement drifting? Or would you like to do advanced inventory , where you can lookup your warranty state against Lenovo or Dell warranty, then keep...

msticpy

MSTIC JupyterとPythonセキュリティツール Microsoft脅威インテリジェンスPythonセキュリティツール。 msticpy は、Jupyter Notebookにおける情報セキュリティ調査とハンティングのためのライブラリです。以下の機能を提供します： 複数のソースからログデータをクエリ 脅威インテリジェンス、地理位置情報、Azureリソースデータでデータをエンリッチ ログから活動指標（IoA）を抽出し、エンコードされたデータを展開 異常なセッション検出や時系列分解などの高度な分析を実行...

log-horizon

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...

Exploitarium-Detections

Exploitarium KQL Detection Coverage KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of 15+ distinct vulnerability targets across 109+ tracked files, released without vendor notification on June 23, 202...

Sentinel-Queries

KQL for Microsoft Sentinel 一些使用 KQL for Microsoft Sentinel 的技巧、示例和实例。 1. 简介 2. KQL 查询的结构 3. 基础知识 1. 时间基础 2. Where 基础 3. Project 基础 4. Summarize 基础 5. Render 基础 6. Parse 与 Split 基础 简介 Kusto 查询语言是一种用于 Azure Monitor、Azure Data Explorer 和 Azure Log Analytics（Microsoft Sentinel 底层使用的语言）的语言。我一直觉得下面这张关于...

KQL_sentinel_CVE-2025-21333

This repository does not have a README...

KQL-threat-hunting-queries

使用 KQL 查询进行威胁狩猎/检测 root@kitploit: | |/ / | | | | | | | | | / | | | | | | | | | \ | | | | \ | |/ | | ' | | | | | | | | || | | | | / \ | | | || | | | | | | | | | || | | | | . | || | | | | | | !NOTE 1月27日：经过近一年的贡献，这个仓库正在进行大规模重建，以适应当前的社区环境，并实现更好的情境化，以便继续贡献。 本仓库旨在提供现成的检测和狩猎查询（以及更多），以帮助分析师和威胁猎人利用...

Microsoft-Sentinel-SecOps

Microsoft Sentinel - SEC 运营 欢迎使用 Microsoft Sentinel - SOC 运营 此存储库包含许多 Microsoft Sentinel 内容，其中包含用于探索、狩猎和其他活动的查询。 资源 狩猎 进程 安全事件 更新 其他内容 Elli Shlomo 博客上的 Azure Sentinel 文章 贡献 本项目欢迎贡献和建议。大多数贡献需要您同意一份贡献者许可协议（CLA），声明您有权且确实授予我们使用您贡献的权利。...

Reconstructing AI activity in investigations

AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...

Microsoft named a Leader in the 2025 Gartner® Magic Quadrant™ for SIEM

We’re honored to share that Microsoft has again been recognized as a Leader in the2025 Gartner® Magic Quadrant™ for Security Information and Event Management SIEM.1 We believe this recognition reinforces Microsoft Sentinel's position as an industry-leading, cloud and AI-powered SIEM—designed to...

Microsoft named a Leader in the 2025 Gartner® Magic Quadrant™ for SIEM

We’re honored to share that Microsoft has again been recognized as a Leader in the2025 Gartner® Magic Quadrant™ for Security Information and Event Management SIEM.1 We believe this recognition reinforces Microsoft Sentinel's position as an industry-leading, cloud and AI-powered SIEM—designed to...

Microsoft raises the bar: A smarter way to measure AI for cybersecurity

ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...

Empowering defenders in the era of agentic AI with Microsoft Sentinel

Microsoft unveils a new wave of security innovation—delivering an agentic platform to protect organizations at scale We are living through a turning point in how organizations work and defend themselves. Across industries, “Frontier Firms” are emerging; these are businesses where humans and AI...

Microsoft Defender delivered 242% return on investment over three years​​

The latest Forrester Total Economic Impact™ TEI study reveals a 242% return on investment ROI over three years for organizations that chose Microsoft Defender. It helps security leaders consolidate tools, reduce overhead, and empower their security operations SecOps teams with operational...

Microsoft Sentinel data lake: Unify signals, cut costs, and power agentic AI

You can’t protect what you can’t see. Security operations teams have long been faced with the challenge of managing massive, fast-growing datasets, and the cost of scaling traditional data management tools to handle these data volumes has become unsustainable. We’re evolving our industry-leading...

Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers

In November 2023, Microsoft announced our strategy to unify security operations by bringing the best of XDR and SIEM together. Our first step was bringing Microsoft Sentinel into the Defender portal, giving teams a single, comprehensive view of incidents, reducing queue management, enriched threa...

Microsoft is named a Leader in The Forrester Wave™: Security Analytics Platforms, 2025​​

What is a security operations center? Learn more ↗ Microsoft is proud to be named a Leader in The Forrester Wave™: Security Analytics Platforms, Q2 2025—which we believe reflects our deep investment in innovation and commitment to support security operations centers SOCs’s critical mission. This...

Silk Typhoon targeting IT supply chain

Executive summary: Microsoft Threat Intelligence identified a shift in tactics by Silk Typhoon, a Chinese espionage group, now targeting common IT solutions like remote management tools and cloud applications to gain initial access. While they haven't been observed directly targeting Microsoft...