Alternatives and similar repositories for spl-to-kql:

Users that are interested in spl-to-kql are comparing it to the libraries listed below

• FalconForceTeam / KQLAnalyzer
  REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.
  ☆32Updated last month
• cylaris / awesomekql
  Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs
  ☆52Updated last year
• invictus-ir / Blue-team-app-Office-365-and-Azure
  ☆72Updated 4 months ago
• jangeisbauer / AdvancedHunting
  Advanced Hunting Queries for Microsoft Security Products
  ☆106Updated 2 years ago
• WillOram / AzureAD-incident-response
  Notes on responding to security breaches relating to Azure AD
  ☆101Updated 2 years ago
• gmellini / Microsoft-Defender-Security-Center-Hunting-Queries
  Hunting Queries for Microsoft Defender Security Center https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defe…
  ☆39Updated 3 years ago
• reprise99 / kql-for-dfir
  A guide to using Azure Data Explorer and KQL for DFIR
  ☆102Updated 2 years ago
• olafhartong / MDE-AuditCheck
  MDE relies on some of the Audit settings to be enabled
  ☆97Updated 2 years ago
• 0xAnalyst / DefenderATPQueries
  Hunting Queries for Defender ATP
  ☆81Updated 2 weeks ago
• miladaslaner / AdvHuntingCheatSheet
  Microsoft Threat Protection Advance Hunting Cheat Sheet
  ☆79Updated 4 years ago
• reversinglabs / reversinglabs-siem-rules
  A collection of various SIEM rules relating to malware family groups.
  ☆65Updated 8 months ago
• m4nbat / KustQueryLanguage_kql
  Cyber Defence related kusto queries for use in Azure Sentinel and Defender advanced hunting
  ☆63Updated this week
• zolderio / misp-to-sentinel
  Azure function to insert MISP data in to Azure Sentinel
  ☆31Updated 2 years ago
• secgroundzero / KQL_Reference_Manual
  ☆41Updated 3 years ago
• humio / security_monitoring
  ☆41Updated last year
• cudeso / misp2sentinel
  MISP to Sentinel integration
  ☆63Updated 3 months ago
• reprise99 / Azure-Sentinel
  Cloud-native SIEM for intelligent security analytics for your entire enterprise.
  ☆20Updated 3 years ago
• RoqueNight / DefenderATP-Proactive-Threat-Hunting-Queries-KQL
  List of custom developed KQL queries to help proactive security teams hunt for opportunistic and sophisticated threat activity by develop…
  ☆25Updated 3 years ago
• mdecrevoisier / Splunk-input-windows-baseline
  Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE…
  ☆90Updated 2 weeks ago
• MHaggis / notes
  Full of public notes and Utilities
  ☆98Updated last month
• target / Threat-Hunting
  Detection of obfuscated Powershell commands
  ☆54Updated last year
• LogRhythm-Labs / Sigma
  Convert Sigma rules to LogRhythm searches
  ☆20Updated 3 years ago
• SophosRapidResponse / OSQuery
  ☆83Updated this week
• center-for-threat-informed-defense / summiting-the-pyramid
  Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…
  ☆35Updated 3 weeks ago
• DefensiveOrigins / DO-LAB
  ☆46Updated this week
• socprime / the-prime-hunt
  A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation
  ☆76Updated 9 months ago
• iknowjason / BlueCloud
  Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.
  ☆129Updated 2 years ago
• swisscom / Invoke-Forensics
  Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.
  ☆112Updated last year
• siriussecurity / dettectinator
  Dettectinator - The Python library to your DeTT&CT YAML files.
  ☆109Updated last month
• thremulation-station / thremulation-station
  Small-scale threat emulation and detection range built on Elastic and Atomic Redteam.
  ☆37Updated last year