This repository is a collection of custom Kusto Query Language (KQL) queries for running security monitoring in Microsoft's Azure cloud hosting platform. Some require some customisation before use, there are comments next to variables that require customisation detailing what steps to take.
These queries are primarily designed for use in the Azure Sentinel and 365 Defender, although they could also form the basis of queries for use in other tools that accept KQL like Microsoft Advanced Threat Protection (ATP).
- General
- Active Directory
- Azure Active Directory
- Azure Key Vault
- Defender for Endpoint
- Office 365
- AWS CloudTrail
Queries in this repo are a mixture of self-written Kusto and code originally obtained from reprise99 and lawndoc.