This repository will be used to publish Hunting Queries or Detection rules that can be used within Azure Sentinel or Defender For Endpoint. The queries are written in KQL they can be used within Sentinel to build Analytics Rules or in Defender For Endpoint (with minor adjustments). If you have any questions feel free to reach out to me on twitter @BertJanCyber.

• Zero Day Detection
• Threat Hunting
• Full Threat Hunting Cases
• Defender For Endpoint detection rules
• Defender For Identity detection rules
• Defender For Cloud Apps detection rules
• Vulnerability Management
• DFIR (Digital Forensics and Incident Response)
• Sentinel
• Azure Active Directory
• Office 365
• KQL Regex Example List

• Open security.microsoft.com
• Hunting
• Advanced Hunting

• Open portal.azure.com
• Search for Sentinel
• Open Sentinel
• Logs

KQL queries can be used in both Defender For Endpoint and Azure Sentinel. The syntax is almost the same. The main difference is the field that indicates the time. It must be adjusted according to the product used. In Sentinel, the 'TimeGenerated' field is used. In DFE it is 'Timestamp'. The queries below show both in DFE and in Azure Sentinel 10 DeviceEvents of the last 7 days.

DeviceEvents
| where Timestamp > ago(7d)
| take 10

DeviceEvents
| where TimeGenerated > ago(7d)
| take 10

This repository will be used to publish Hunting Queries or Detection rules that can be used within Azure Sentinel or Defender For Endpoint. The queries are written in KQL they can be used within Sentinel to build Analytics Rules or in Defender For Endpoint (with minor adjustments). If you have any questions feel free to reach out to me on twitter @BertJanCyber.

• Open security.microsoft.com
• Hunting
• Advanced Hunting

• Open portal.azure.com
• Search for Sentinel
• Open Sentinel
• Logs

KQL queries can be used in both Defender For Endpoint and Azure Sentinel. The syntax is almost the same. The main difference is the field that indicates the time. It must be adjusted according to the product used. In Sentinel, the 'TimeGenerated' field is used. In DFE it is 'Timestamp'. The queries below show both in DFE and in Azure Sentinel 10 DeviceEvents of the last 7 days.

DeviceEvents
| where Timestamp > ago(7d)
| take 10

DeviceEvents
| where TimeGenerated > ago(7d)
| take 10

• KQL Quick Reference Guide
• KQL Tutorial
• KQL Cheat Sheet PDF