Azure/Azure-Sentinel

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

6076 stars · 3790 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

The official community repository for Microsoft Sentinel, a cloud-native SIEM, containing out-of-the-box detections, hunting queries, workbooks, playbooks, and sample code. It provides security analytics content for threat detection and hunting across Microsoft Sentinel and Microsoft 365 Defender environments.

Use cases

• find hunting queries for threat detection in Microsoft Sentinel
• get out-of-the-box detection rules for my SOC
• build KQL queries for Microsoft 365 Defender advanced hunting
• automate incident response with Sentinel playbooks
• contribute security analytics content to a SIEM
• set up workbooks for security monitoring dashboards

When to choose

• you use Microsoft Sentinel or Microsoft 365 Defender and need ready-made detection and hunting content
• you want community-contributed playbooks, workbooks, and queries for Azure security operations
• you are building a SOC on Azure and want to accelerate onboarding

When to avoid

• you need a standalone open-source SIEM rather than content for Microsoft's paid cloud SIEM
• your environment is not on Azure or Microsoft 365
• you want a self-hosted SIEM like Wazuh or Elastic Security

Facets

application · maturity active

security monitoring alerting analytics search-engine security cloud-computing monitoring cloud self-hosted python siem soc threat-hunting microsoft-sentinel detection-rules kql playbooks soar microsoft-365-defender security-content devops

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Azure/Azure-Sentinel")