Alternatives and similar repositories for KQL

Users that are interested in KQL are comparing it to the libraries listed below

• SubashGhimire / Hunting-Queries-and-Detection-Rule-Microsoft-Sentinel-Defender
  KQL Sentinel and Defender Detection and Hunting Queries.
  ☆13Updated 2 months ago
• PuravsPoint / DecipheringUAL
  This repo aims to help you decipher the UAL from a Digital Forensics & Incident Response (DFIR) perspective. The UAL is the Microsoft 365…
  ☆62Updated last year
• alexverboon / Hunting-Queries-Detection-Rules
  KQL Queries. Microsoft Defender, Microsoft Sentinel
  ☆187Updated 2 weeks ago
• f-bader / AzSentinelQueries
  Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.
  ☆133Updated last week
• CyberAutomationX / SecureAzCloud-Scripts
  ☆100Updated last month
• rod-trent / Sentinel-SOC-101
  Content and collateral for the Microsoft Sentinel SOC 101 series
  ☆202Updated last year
• KernelCaleb / Kustonomicon
  A series of cloud focused KQL queries for threat hunting and DFIR
  ☆10Updated last month
• ml58158 / Demystifying-KQL
  Content Repo for Demystifying KQL Tutorial Series
  ☆71Updated last year
• ep3p / Sentinel_KQL
  In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (…
  ☆132Updated last month
• lorisAmbrozzo / KQL-Queries
  Repository with Hunting and Detection Queries for Microsoft Sentinel and Microsoft Defender XDR
  ☆16Updated 3 weeks ago
• ionsec / maes-platform
  MAES: M365 Analyzer & Extractor Suite Po
  ☆31Updated this week
• DanielChronlund / DCSecurityOperations
  A collection of Microsoft Sentinel workbooks and analytics rules.
  ☆111Updated last year
• JeffMichelmore / M365D-API
  ☆19Updated last year
• cyb3rmik3 / MDE-DFIR-Resources
  A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as …
  ☆415Updated 3 months ago
• jkerai1 / KQL-Queries
  KQL Queries
  ☆23Updated 3 weeks ago
• lawndoc / AdvancedHuntingQueries
  Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant.
  ☆129Updated 5 months ago
• EEN421 / KQL-Queries
  Ian Hanley's deceptively simple KQL queries.
  ☆62Updated last month
• HybridBrothers / Hybrid-Brothers-Projects
  This repository contains various public projects created by the owners of Hybrid Brothers
  ☆21Updated 2 years ago
• LearningKijo / LearningKijo
  Config files for my GitHub profile.
  ☆25Updated 7 months ago
• LearningKijo / KQL
  Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
  ☆483Updated last year
• rod-trent / KQLMysteries
  The collateral repository for The KQL Mysteries series
  ☆27Updated last year
• reprise99 / awesome-kql-sentinel
  A curated list of blogs, videos, tutorials, queries and anything else valuable to help you learn and master KQL and Microsoft Sentinel
  ☆236Updated 2 years ago
• KQLMSPress / definitive-guide-kql
  Sample queries and data as part of the Microsoft Press book, The Definitive Guide to KQL
  ☆276Updated last year
• Cloud-Architekt / AzureSentinel
  Sharing my KQL queries for Azure Sentinel
  ☆191Updated 3 weeks ago
• LETHAL-FORENSICS / Microsoft-Analyzer-Suite
  A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
  ☆561Updated last month
• LouisMastelinck / Monitor-security-policy-changes-or-admin-activities
  ☆21Updated last year
• Bert-JanP / SecScripts
  Security Scripts and Sources for daily usage.
  ☆67Updated last month
• samikroy / ms-sentinel-scout
  ☆16Updated 3 months ago
• cyb3rmik3 / KQL-threat-hunting-queries
  A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 D…
  ☆746Updated 3 months ago
• markolauren / sentinel
  ☆51Updated 2 weeks ago