Skip to content

threechord82/SentinelKQL

BranchesTags
 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

52 Commits
ActiveIncidents.txt
ActiveIncidents.txt
 
 
AddedorAssignedGlobalAdministratorroleperms.txt
AddedorAssignedGlobalAdministratorroleperms.txt
 
 
AnalyticsRulesRunbyTimes.txt
AnalyticsRulesRunbyTimes.txt
 
 
Azure Runbooks query with correlation.txt
Azure Runbooks query with correlation.txt
 
 
BillableDatabyDataType.txt
BillableDatabyDataType.txt
 
 
BookMarkUpdatedBy.txt
BookMarkUpdatedBy.txt
 
 
BookmarkUpdate.txt
BookmarkUpdate.txt
 
 
BookmarksCreatedBy.txt
BookmarksCreatedBy.txt
 
 
BreakGlassAccount.txt
BreakGlassAccount.txt
 
 
BrowserActivitybyGEO.txt
BrowserActivitybyGEO.txt
 
 
CEFDevices.txt
CEFDevices.txt
 
 
Check4LockedoutUser.txt
Check4LockedoutUser.txt
 
 
CloudShell.txt
CloudShell.txt
 
 
Cloudshell2.txt
Cloudshell2.txt
 
 
Conditional access changes new value and old value.txt
Conditional access changes new value and old value.txt
 
 
CostperEventID.txt
CostperEventID.txt
 
 
Cross resource query.txt
Cross resource query.txt
 
 
DataByProvider.txt
DataByProvider.txt
 
 
Debugging authentication sign-ins.txt
Debugging authentication sign-ins.txt
 
 
DirectAgent.txt
DirectAgent.txt
 
 
DirectReport.txt
DirectReport.txt
 
 
Does a table exist.txt
Does a table exist.txt
 
 
DomainAdminsEnterpriseAdmins.txt
DomainAdminsEnterpriseAdmins.txt
 
 
Duration of session.txt
Duration of session.txt
 
 
EventIDsinLastDay.txt
EventIDsinLastDay.txt
 
 
EventLogSources.txt
EventLogSources.txt
 
 
GetTags.txt
GetTags.txt
 
 
ImpossibleTravelKQL.txt
ImpossibleTravelKQL.txt
 
 
Incidents.txt
Incidents.txt
 
 
IntuneActivityTypes.txt
IntuneActivityTypes.txt
 
 
IntuneAuditEvents.txt
IntuneAuditEvents.txt
 
 
IntuneAuditEventsTrend.txt
IntuneAuditEventsTrend.txt
 
 
IntuneComplianceFailuresbyOperatingSystem.txt
IntuneComplianceFailuresbyOperatingSystem.txt
 
 
IntuneComplianceFailuresbyReason.txt
IntuneComplianceFailuresbyReason.txt
 
 
IntuneCountofSuccessfulEnrollmentsbyOS.txt
IntuneCountofSuccessfulEnrollmentsbyOS.txt
 
 
IntuneDevicesNotinCompliance.txt
IntuneDevicesNotinCompliance.txt
 
 
IntuneEnrollmentEventsTrend.txt
IntuneEnrollmentEventsTrend.txt
 
 
IntuneEnrollmentFailurereasons.txt
IntuneEnrollmentFailurereasons.txt
 
 
IntuneEnrollmentFailuresbyEnrollmentType.txt
IntuneEnrollmentFailuresbyEnrollmentType.txt
 
 
IntuneEnrollmentFailuresbyPlatform.txt
IntuneEnrollmentFailuresbyPlatform.txt
 
 
IntuneEnrollmentStatistics.txt
IntuneEnrollmentStatistics.txt
 
 
IntuneEnrollmentSuccessbyEnrollmentType.txt
IntuneEnrollmentSuccessbyEnrollmentType.txt
 
 
IntuneNotCompliant.txt
IntuneNotCompliant.txt
 
 
IntuneRecentEventsbyAccounts.txt
IntuneRecentEventsbyAccounts.txt
 
 
IntuneRemoteactionsbyactiontype.txt
IntuneRemoteactionsbyactiontype.txt
 
 
IntuneRemoteactionstopusers.txt
IntuneRemoteactionstopusers.txt
 
 
IntuneSuccessfulSynchedDevice.txt
IntuneSuccessfulSynchedDevice.txt
 
 
IntuneSummarizebyOperation.txt
IntuneSummarizebyOperation.txt
 
 
IntuneTopuserswithauditedactions.txt
IntuneTopuserswithauditedactions.txt
 
 
IntuneisCompliantByOSandOSVersion.txt
IntuneisCompliantByOSandOSVersion.txt
 
 
LAG analysis example.txt
LAG analysis example.txt
 
 
Language demo just for fun and demo pattern replace.txt
Language demo just for fun and demo pattern replace.txt
 
 
Latency for a Log Analytics example with rolling percentiles.txt
Latency for a Log Analytics example with rolling percentiles.txt
 
 
LineNumbers-serialize.txt
LineNumbers-serialize.txt
 
 
LookingforInstalledKBIDs.txt
LookingforInstalledKBIDs.txt
 
 
Make series to fill in gaps with default for bin by bucket.txt
Make series to fill in gaps with default for bin by bucket.txt
 
 
Make-series for gaps.txt
Make-series for gaps.txt
 
 
NSGChangesByUser.txt
NSGChangesByUser.txt
 
 
NewBruteForceAttacks.txt
NewBruteForceAttacks.txt
 
 
PowerShellExecution.txt
PowerShellExecution.txt
 
 
README.md
README.md
 
 
Running total aka cumulative sum.txt
Running total aka cumulative sum.txt
 
 
SMA and EMA examples.txt
SMA and EMA examples.txt
 
 
SecurityIndicentsCreatedinLastDay.txt
SecurityIndicentsCreatedinLastDay.txt
 
 
SentinelIncidentURLs- ALL.txt
SentinelIncidentURLs- ALL.txt
 
 
SharePointDownloads.txt
SharePointDownloads.txt
 
 
SigninLogsByBrowserandLocation.txt
SigninLogsByBrowserandLocation.txt
 
 
SophosDisabled.txt
SophosDisabled.txt
 
 
SuccessfulRoleAssignments.txt
SuccessfulRoleAssignments.txt
 
 
SystemthatHaveUpdatedintheLast4Hours.txt
SystemthatHaveUpdatedintheLast4Hours.txt
 
 
TimeBetweenDates.txt
TimeBetweenDates.txt
 
 
Top N by Group example via top-nested - option 2.txt
Top N by Group example via top-nested - option 2.txt
 
 
Top N by group example via LAG - option 1.txt
Top N by group example via LAG - option 1.txt
 
 
Tracking Privileged Account Rare Activity without AWS.txt
Tracking Privileged Account Rare Activity without AWS.txt
 
 
UpdateDataConnectors.txt
UpdateDataConnectors.txt
 
 
UserAccountLockedAAD.txt
UserAccountLockedAAD.txt
 
 
WhoDeletedAlertRule.txt
WhoDeletedAlertRule.txt
 
 
acrossworkspaceforFunction.txt
acrossworkspaceforFunction.txt
 
 
adminskql.txt
adminskql.txt
 
 
allreportingcomputers.txt
allreportingcomputers.txt
 
 
computersendingmostsecurityalerts.txt
computersendingmostsecurityalerts.txt
 
 
computersunhealthystate.txt
computersunhealthystate.txt
 
 
dataparser.txt
dataparser.txt
 
 
devices.txt
devices.txt
 
 
excessivefailedlogins.txt
excessivefailedlogins.txt
 
 
heartbeatforscomagent.txt
heartbeatforscomagent.txt
 
 
isempty.txt
isempty.txt
 
 
multipleLAworkspaces.txt
multipleLAworkspaces.txt
 
 
qualys.txt
qualys.txt
 
 
scalarexpression.txt
scalarexpression.txt
 
 
serversenrolledinWDATP.txt
serversenrolledinWDATP.txt
 
 

Repository files navigation

SentinelKQL

Azure Sentinel KQL

About

Azure Sentinel KQL

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

No packages published