msticpy

MSTIC Jupyter и инструменты безопасности Python Инструменты безопасности Python Microsoft Threat Intelligence. msticpy — это библиотека для исследования и охоты в сфере InfoSec в Jupyter Notebooks. Она включает функциональность для: запроса данных журналов из нескольких источников обогащения данн...

ClientInspectorV2

Introduction to ClientInspector v2 Вы контролируете ситуацию? — или некоторые из ваших основных процессов инфраструктуры, такие как патчинг, антивирус, включение BitLocker , отклоняются? Или вы хотите проводить расширенную инвентаризацию , где можете проверить гарантийный статус по гарантии Lenov...

Azure-Sentinel

Microsoft Sentinel и Microsoft 365 Defender Добро пожаловать в единый репозиторий Microsoft Sentinel и Microsoft 365 Defender! Этот репозиторий содержит готовые детекции, запросы для исследования, запросы для охоты, книги, плейбуки и многое другое, чтобы помочь вам освоиться с Microsoft Sentinel ...

Hunting-Queries-Detection-Rules

KQL запросы Sentinel и Defender KQL для Defender XDR, Microsoft Sentinel и других решений Microsoft Цель этого репозитория — делиться KQL-запросами, которые могут использоваться любым человеком и быть понятными. Эти запросы предназначены для увеличения охвата обнаружения через логи продуктов...

log-horizon

Microsoft Sentinel SIEM Log Source Analyzer Я не сосчитаю, сколько раз мне приходилось отвечать на вопросы «Что мы на самом деле получаем из этих логов?» или «Какие логи рекомендованы для Microsoft Sentinel?» Ответ всегда зависит от множества факторов, но можно дать общие рекомендации. Поэтому я ...

Exploitarium-Detections

Покрытие обнаружения KQL Exploitarium Правила обнаружения KQL для Microsoft Sentinel и Defender XDR, охватывающие анонимное раскрытие bikini/exploitarium — личный исследовательский архив из более чем 15 различных целей уязвимостей в более чем 109 отслеживаемых файлах, опубликованный без уведомлен...

KQL_sentinel_CVE-2025-21333

В этом репозитории нет README...

Sentinel-Queries

KQL per Microsoft Sentinel Alcuni suggerimenti, trucchi ed esempi per l'uso di KQL con Microsoft Sentinel. 1. Introduzione 2. L'anatomia di una query KQL 3. Le basi 1. Nozioni di base sul tempo 2. Nozioni di base su Where 3. Nozioni di base su Project 4. Nozioni di base su Summarize 5. Nozioni di...

Microsoft-Sentinel-SecOps

Microsoft Sentinel - Operazioni SOC Benvenuto in Microsoft Sentinel - Operazioni SOC Questo repository contiene molti contenuti di Microsoft Sentinel con query per esplorazione, caccia alle minacce e altre attività. Risorse Hunting Processi Eventi di sicurezza Aggiornamenti Varie Articoli su Azur...

KQL-threat-hunting-queries

Threat hunting/detecting using KQL queries root@kitploit: | |/ / | | | | | | | | | / | | | | | | | | | \ | | | | \ | |/ | | ' | | | | | | | | || | | | | / \ | | | || | | | | | | | | | || | | | | . | || | | | | | | !NOTE 27 gennaio: dopo quasi un anno di contributi, questo repository è in fase...

Reconstructing AI activity in investigations

AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...

Microsoft named a Leader in the 2025 Gartner® Magic Quadrant™ for SIEM

We’re honored to share that Microsoft has again been recognized as a Leader in the2025 Gartner® Magic Quadrant™ for Security Information and Event Management SIEM.1 We believe this recognition reinforces Microsoft Sentinel's position as an industry-leading, cloud and AI-powered SIEM—designed to...

Microsoft named a Leader in the 2025 Gartner® Magic Quadrant™ for SIEM

We’re honored to share that Microsoft has again been recognized as a Leader in the2025 Gartner® Magic Quadrant™ for Security Information and Event Management SIEM.1 We believe this recognition reinforces Microsoft Sentinel's position as an industry-leading, cloud and AI-powered SIEM—designed to...

Microsoft raises the bar: A smarter way to measure AI for cybersecurity

ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...

Empowering defenders in the era of agentic AI with Microsoft Sentinel

Microsoft unveils a new wave of security innovation—delivering an agentic platform to protect organizations at scale We are living through a turning point in how organizations work and defend themselves. Across industries, “Frontier Firms” are emerging; these are businesses where humans and AI...

Microsoft Defender delivered 242% return on investment over three years​​

The latest Forrester Total Economic Impact™ TEI study reveals a 242% return on investment ROI over three years for organizations that chose Microsoft Defender. It helps security leaders consolidate tools, reduce overhead, and empower their security operations SecOps teams with operational...

Microsoft Sentinel data lake: Unify signals, cut costs, and power agentic AI

You can’t protect what you can’t see. Security operations teams have long been faced with the challenge of managing massive, fast-growing datasets, and the cost of scaling traditional data management tools to handle these data volumes has become unsustainable. We’re evolving our industry-leading...

Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers

In November 2023, Microsoft announced our strategy to unify security operations by bringing the best of XDR and SIEM together. Our first step was bringing Microsoft Sentinel into the Defender portal, giving teams a single, comprehensive view of incidents, reducing queue management, enriched threa...

Microsoft is named a Leader in The Forrester Wave™: Security Analytics Platforms, 2025​​

What is a security operations center? Learn more ↗ Microsoft is proud to be named a Leader in The Forrester Wave™: Security Analytics Platforms, Q2 2025—which we believe reflects our deep investment in innovation and commitment to support security operations centers SOCs’s critical mission. This...

Silk Typhoon targeting IT supply chain

Executive summary: Microsoft Threat Intelligence identified a shift in tactics by Silk Typhoon, a Chinese espionage group, now targeting common IT solutions like remote management tools and cloud applications to gain initial access. While they haven't been observed directly targeting Microsoft...