Bert-JanP/Hunting-Queries-Detection-Rules resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1732 stars · 326 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated collection of KQL queries for Microsoft Defender for Endpoint and Azure Sentinel, covering advanced hunting, custom detections, analytics rules, and hunting rules. It is a community-maintained rule/query library aimed at increasing detection coverage from Microsoft security logs.

Use cases

• find kql queries for microsoft sentinel hunting
• create custom detection rules in defender for endpoint
• improve soc detection coverage with out-of-the-box kql queries
• hunt for suspicious activity in mde logs
• write analytics rules for azure sentinel
• threat hunt for zero-day exploitation techniques
• build visualizations for security logs in kql

When to choose

• you use Microsoft Sentinel or Defender for Endpoint/XDR and need ready-made KQL detections
• you are a blue teamer or detection engineer expanding coverage beyond default alerts
• you need reference queries for incident response in Microsoft security products

When to avoid

• you use SIEM/EDR products other than Microsoft's (e.g., Splunk, Elastic)
• you need a runnable tool or service rather than a query collection
• you need Sigma or YARA rules instead of KQL

Facets

dataset · maturity active

security monitoring alerting developer-tools security cloud-computing developer-tools cloud self-hosted kql microsoft-sentinel defender-for-endpoint threat-hunting detection-engineering dfir blue-team detection-rules

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Bert-JanP/Hunting-Queries-Detection-Rules")