Alternatives and similar repositories for KqlTools

Users that are interested in KqlTools are comparing it to the libraries listed below

• maartengoet / KQL
  KQL queries
  ☆13Updated 6 years ago
• KnudsenMorten / AzureLogLibrary
  AzureLogLibrary - repository used for Azure logging with ARM-templates, scripts, documentation to deploy DCRs, extensions, etc
  ☆14Updated 2 years ago
• jsa2 / aad-auth-n-z
  ☆67Updated 3 years ago
• SureStacks / AzureAssess
  Assess Azure Security State
  ☆37Updated last year
• MicrosoftDocs / ATADocs
  Public content repo for ATA documentation in OPS
  ☆75Updated 9 months ago
• microsoft / EventLogExpert
  ☆220Updated 6 months ago
• microsoft / ASDET
  ☆19Updated 4 years ago
• merill / graph-permissions-explorer
  Repository for public site hosting graph permissions
  ☆30Updated last week
• jkerai1 / SoftwareCertificates
  Repository for Software Certs for easy software blocking across corp environments, for example, using MDE IOC
  ☆58Updated last week
• nicolonsky / ITDR
  Collection of Microsoft Identity Threat Detection and Response resources.
  ☆51Updated last week
• f-bader / SentinelARConverter
  Sentinel Analytics Rule converter PowerShell module
  ☆65Updated last week
• rod-trent / KQL-for-Everything
  KQL example queries for working in Azure
  ☆35Updated last week
• merill / microsoft-info
  Repository hosting a static list of Microsoft First party apps and Graph permissions that's updated daily
  ☆171Updated last week
• PwnDefend / AzureAuditPrep
  ☆13Updated 4 years ago
• FalconForceTeam / KQLAnalyzer
  REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.
  ☆44Updated 2 months ago
• YongRhee-MDE / LiveResponse
  M365 MDATP Live Response sample scripts
  ☆81Updated last year
• JesseEsquivel / MDATP
  Microsoft Defender Advanced Threat Protection
  ☆48Updated 6 months ago
• Devolutions / devolutions-labs
  Self-contained Hyper-V Active Directory Lab Environment
  ☆59Updated last month
• secgroundzero / KQL_Reference_Manual
  ☆43Updated 4 years ago
• microsoft / NetMon_Parsers_for_PacketMon
  This repository includes the parsers necessary for Microsoft Network Monitor to parse etl logs generated by Packet Monitor (Pktmon).
  ☆22Updated 3 years ago
• SecureHats / Sentinel-playground
  Solution to deploy a Sentinel playground demo environment
  ☆57Updated 2 years ago
• Azure / MDTI-Solutions
  Repository to publish sample use cases, templates, solutions, automations for Microsoft Defender Threat Intelligence (MDTI) product
  ☆79Updated last year
• alexverboon / PSMDATP
  PowerShell Module for managing Microsoft Defender Advanced Threat Protection
  ☆74Updated 3 years ago
• KnudsenMorten / ClientInspectorV2
  ClientInspectorV2 - Unleashing the power of Azure LogAnalytics, Azure Data Collection Rules, Log Ingestion API by doing client inventory …
  ☆25Updated 2 years ago
• wfraser / EseView
  A graphical ESE (aka ESENT or JET) database viewer.
  ☆25Updated 10 years ago
• azsec / azure-sentinel-tools
  A collection of scripts and works related to Azure Sentinel
  ☆41Updated 3 years ago
• microsoft / microsoft-defender-for-endpoint-manageability
  Microsoft Defender ATP Manageability and Maintenance scripts
  ☆28Updated 2 years ago
• Kaidja / Defender-for-Endpoint
  Defender for Endpoint
  ☆27Updated last year
• le0li9ht / Microsoft-Sentinel-Queries
  KQL queries for cyber defense and for solving daily issues
  ☆54Updated 4 months ago
• pkhabazi / sentineldevops
  Deploying and Managing Azure Sentinel – Ninja style
  ☆32Updated 5 years ago