microsoft-sentinel-kql

Here are 9 public repositories matching this topic...

neelkotnis / kql-detection-rules

32 production-quality KQL detection rules for Microsoft Sentinel, mapped to MITRE ATT&CK for Cloud, credential access, lateral movement, exfiltration, defense evasion, and more

azure threat-modeling devsecops threat-intelligence detection-rules blue-team mitre-attack threat-detection kql detection-engineering mitre-attack-framework microsoft-sentinel mitre-attack-cloud-security microsoft-sentinel-workbook microsoft-sentinel-kql

Updated Aug 1, 2026

AdityaBhatt3010 / Microsoft-Sentinel-Understanding-Cloud-Native-SIEM-and-SOAR

Sponsor

Star

Microsoft Sentinel, SIEM, SOAR, KQL, SOC Operations: Explore cloud-native security monitoring, threat detection, incident investigation, and automated response workflows.

sentinel cybersecurity siem soar microsoft-sentinel microsoft-sentinel-kql

Updated Jul 14, 2026

annKimani-ICS / Sentinel-SOC-Homelab

Star

A Microsoft Sentinel SOC homelab in Azure, where I built and validated a basic cloud SOC workflow: data onboarding, detection, investigation, and visualization. It demonstrates practical blue-team skills in SIEM operations, KQL-based threat hunting, watchlist enrichment, and workbook reporting.

microsoft-azure microsoft-sentinel kql-threathunting incident-triage soc-analysis microsoft-sentinel-workbook incident-logging microsoft-sentinel-kql

Updated Jun 2, 2026

buddhamahidhar22-prog / Microsoft-Sentinel-MITRE-ATT-CK-Purple-Team-Detection-Pipeline

Star

Microsoft Sentinel purple team detection engineering using Atomic Red Team, Sysmon, KQL, and MITRE ATT&CK.

sysmon mitre-attack threat-detection purple-team security-operations kql detection-engineering atomic-red-team microsoft-sentinel security-operations-center threat-detection-response security-operations-engineer security-operations-analyst security-operations-analyst-certification microsoft-sentinel-kql

Updated Aug 13, 2026

JuttSahib1999 / SIEM-AI-Query-Translator

Star

A completely free, AI-powered assistant that translates natural language SOC analyst questions into precise Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, and Wazuh SIEM queries. Built for threat hunters.

python dfir cybersecurity threat-hunting siem wazuh kql splunk-spl streamlit microsoft-sentinel generative-ai soc-analyst microsoft-sentinel-kql elastic-kql

Updated Aug 6, 2026
Python

bigcnash / SOC-Incident-Response-Lab

Star

End-to-end SOC incident response lab using Microsoft Sentinel, KQL, TheHive, and Docker to detect, triage, investigate, document, and respond to suspicious authentication activity

docker azure incident-response cybersecurity threat-hunting siem thehive soc azurevm microsoft-sentinel microsoft-sentinel-kql

Updated Aug 2, 2026

Cloud2BR-MSFTLearningHub / Sentinel-Setup-Overview

Star

This repository contains demos and guides on how to setup Sentinel for Cloud. These demos are intended as a guide. For official guidance, support, or more detailed information, please refer to Microsoft's official documentation or contact Microsoft directly.

security sentinel microsoft-sentinel microsoft-sentinel-workbook microsoft-sentinel-kql

Updated Aug 3, 2026

AkashBhat10 / MicrosoftSentinel-kql-lab

Star

Microsoft Sentinel cloud SIEM lab - deployed Azure VM, ingested Windows Security Events via AMA, wrote KQL queries to detect brute force attacks and failed logins in real time. Replicates L1 SOC analyst workflows.

azure incident-response cloud-security brute-force-detection microsoft-sentinel-kql siem-log-analytics windows-security-events