Desktop KQL query builder for Microsoft security and Azure services - 52 tables across Defender, Sentinel, Entra ID, Azure Monitor, App Insights, and more
☆47Jun 22, 2026Updated 4 months ago
Alternatives and similar repositories for KustoForge
Users that are interested in KustoForge are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- 32 production-quality KQL detection rules for Microsoft Sentinel, mapped to MITRE ATT&CK for Cloud, credential access, lateral movement, …☆15Aug 1, 2026Updated 2 months ago
- Advanced Threat Hunting: Ransomware Group☆29Jul 9, 2025Updated last year
- Generate Azure Network Diagrams, using diagram-as-code (Graphviz)☆82Aug 17, 2026Updated 2 months ago
- ☆55Oct 8, 2026Updated 3 weeks ago
- Public research documentation, methodology, and STIX examples for TI Mindmap HUB - an AI-powered Cyber Threat Intelligence platform☆20Updated this week
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- A curated toolkit of M365 automation scripts designed to simplify management, accelerate workflows, and improve operational efficiency.☆61Oct 10, 2026Updated 2 weeks ago
- Balanced Scorecard for Cyber Resilience☆13Nov 17, 2025Updated 11 months ago
- Mount forensic disk images, archives & memory dumps as a filesystem on Linux/macOS/Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK/AFF4…☆10Sep 20, 2026Updated last month
- Open-source PowerShell toolkit for Microsoft 365 security investigations - Read-only compromise assessment☆86Mar 9, 2026Updated 7 months ago
- KustoHawk is a lightweight incident triage and response tool designed for effective incident response in Microsoft Defender XDR and Micro…☆160Apr 1, 2026Updated 6 months ago
- Neural network RDP cache reconstruction tool☆36May 21, 2026Updated 5 months ago
- Threat Hunting queries of multiple platforms☆86Updated this week
- Browse Windows Recycle Bin from E01 forensic images with Explorer-style interface. Parse $I/$R artifacts, view deleted files in original …☆18Dec 16, 2025Updated 10 months ago
- Transparent, CLI-interactive intercept proxy for Anthropic’s Claude API.☆13Oct 5, 2026Updated 3 weeks ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Repository containing resources used for 365daysofADX.☆36Mar 4, 2026Updated 7 months ago
- Group centric documentation will provide you with information about your Intune assignments to groups.☆14Nov 9, 2023Updated 2 years ago
- Share Information about Microsoft Security Products☆154Updated this week
- An Obsidian-Based Second Brain for CyberSecurity Analysts and Professionals☆60Feb 18, 2026Updated 8 months ago
- Azure playbook for automatic evidence collection☆13Jul 3, 2023Updated 3 years ago
- GLEAPP - Graphics, Logs, Examination, Automated Processing, Parsing: image and video forensic triage toolkit☆20Updated this week
- Automates the entire workflow for packaging Windows applications and deploying them to Microsoft Intune☆19Updated this week
- Terraform Azure RM Compute Group Module☆10Sep 15, 2026Updated last month
- Microsoft Endpoint Manager related resources☆45Feb 24, 2026Updated 8 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆29May 1, 2025Updated last year
- Free, open-source SQLite viewer and forensic analyzer: search every table, browse millions of rows, decode BLOBs (bplist, protobuf) and t…☆39Oct 21, 2026Updated last week
- A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as …☆475Feb 18, 2026Updated 8 months ago
- Visualize Microsoft Defender XDR process trees and security events☆33Aug 24, 2025Updated last year
- A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 D…☆801Updated this week
- ☆57Updated this week
- Windows EVTX log analysis for DFIR — fast parsing, ATT&CK mapping, IOC extraction, and Sentinel anomaly detection. Normal + Juggernaut Mo…☆60Oct 22, 2026Updated last week
- Companion repo for 'Azure for SaaS Developers' YouTube series — 12 episodes from zero IaC to multi-region production☆21May 3, 2026Updated 5 months ago
- ☆17Aug 25, 2026Updated 2 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Generate Indexes from SANS PDFs☆20Jun 3, 2024Updated 2 years ago
- ☆19Sep 17, 2026Updated last month
- Perform linear algebra operations on Japanese or Chinese characters.☆14Jun 13, 2026Updated 4 months ago
- Repository for Software Certs for easy software blocking across corp environments, for example, using MDE IOC☆91Oct 8, 2026Updated 3 weeks ago
- Sharing my KQL queries for Azure Sentinel☆226Aug 4, 2026Updated 2 months ago
- SOCAutomators Substack blog companion — threat research, DBIR analysis, and security operations content☆21Jun 3, 2026Updated 4 months ago
- Static + live analysis of Windows kernel drivers: extract IOCTL codes and shared ring-buffer strings, then load the driver and verify eve…☆27Aug 24, 2026Updated 2 months ago