A comprehensive collection of Kusto Query Language (KQL) queries designed for security professionals to detect, hunt, and respond to cyber threats and incidents, covering areas like Detections, Digital Forensics, and Hunting by Entity (Device, Email, User), and including operational queries for incident management and analytics tuning.
☆19Dec 28, 2025Updated 10 months ago
Alternatives and similar repositories for Incident-Response-and-Threat-Hunting
Users that are interested in Incident-Response-and-Threat-Hunting are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Sigma Queries turned into KQL for Defender using pysigma☆12Mar 29, 2026Updated 7 months ago
- ☆57Updated this week
- Monitor/Archive of Azure IAM (Role Definitions and Provider Operations). Tweets at https://twitter.com/maiam_bot☆10Updated this week
- A Post-exploitation Toolset for Interacting with the Microsoft Graph API☆17Nov 16, 2023Updated 2 years ago
- This is for my crappy (but hopefully useful) MDE and Sentinel KQL queries! #KQLThePlanet☆13Jan 24, 2026Updated 9 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- This repository contains detection and threat hunting queries created by NVISO’s CSIRT and SOC teams.☆20Updated this week
- Sentinel BEC IR☆14Aug 18, 2022Updated 4 years ago
- Azure playbook for automatic evidence collection☆13Jul 3, 2023Updated 3 years ago
- Utilities for Microsoft Sentinel☆20Dec 7, 2025Updated 10 months ago
- This repository contains various public projects created by the owners of Hybrid Brothers☆21Nov 3, 2023Updated 2 years ago
- Scanner for Log4j RCE CVE-2021-44228☆11Jul 6, 2022Updated 4 years ago
- ☆15Mar 12, 2025Updated last year
- hashkill password recovery tool☆12Feb 4, 2014Updated 12 years ago
- ☆46Apr 10, 2024Updated 2 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- ☆37Nov 11, 2025Updated 11 months ago
- A fast, native desktop workbench for Azure Data Explorer☆13Updated this week
- Production-ready KQL queries for Microsoft Defender XDR and Microsoft Sentinel. Focused on Threat Hunting, Detection Engineering, and MIT…☆185Oct 22, 2026Updated last week
- Tool to enumerate unregistered reply URLs for single and multitenant apps in Azure☆17Jan 23, 2025Updated last year
- In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (…☆143Oct 22, 2026Updated last week
- InSpec profile to validate an M365 account to the standards of the CIS Microsoft 365 Foundations Benchmark.☆17Dec 14, 2025Updated 10 months ago
- ☆31Oct 28, 2024Updated 2 years ago
- Velociraptor ai skills☆16Sep 28, 2026Updated last month
- Operational Relay Box Intelligence, Tracking, & Analysis Lexicon (ORBITAL)☆38Aug 30, 2026Updated last month
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- This repo contains all the Microsoft Sentinel content build by EightFence for the Community☆14Updated this week
- Collection of scripts / samples / snippits around the community service at www.filescan.io☆20Nov 6, 2025Updated 11 months ago
- ☆43May 22, 2021Updated 5 years ago
- ☆11Jul 1, 2025Updated last year
- ResearchDev - XDR & SIEM Detection☆66Apr 16, 2025Updated last year
- Community-driven PowerShell detection indicators☆47Jan 27, 2026Updated 9 months ago
- Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard☆17Oct 21, 2026Updated last week
- Scripts and Samples for the KQL Pluralsight Course Created in 2022☆23Jan 6, 2023Updated 3 years ago
- Command-line tool to identify useragents that bypasses proxy restrictions☆14Sep 29, 2026Updated 3 weeks ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Programmable Utility for Mobile Automation☆19Updated this week
- Collection of notes, useful resources, list of tools and scripts related to threat detection, digital forensics and incident response.☆14Oct 20, 2026Updated last week
- Runtime security for AI agents. In-process, zero dependencies, Apache 2.0.☆29Updated this week
- Python CLI covering the FileScan.IO API - enabling automatic interaction with www.filescan.io or private instances☆27Jul 15, 2025Updated last year
- Config files for my GitHub profile.☆11Aug 18, 2025Updated last year
- A lightweight Google Chrome extension that helps you seamlessly read premium, "Member-only" articles on Medium by automatically redirecti…☆19Mar 27, 2026Updated 7 months ago
- Microsoft Sentinel SIEM Log Source Analyzer☆31Updated this week