{"adoption": {"forks": 570, "observed_at": "2026-08-28T04:06:12.039189+00:00", "stars": 2087}, "canonical_url": "https://ross.abutalabs.com/products/microsoft-365-defender-hunting-queries", "card": {"archived": true, "artifact_type": "dataset", "description": "Sample queries for Advanced hunting in Microsoft 365 Defender", "domain": ["security", "developer-tools"], "enriched": true, "function": ["security", "search-engine", "developer-tools"], "health_score": 10, "homepage": null, "language": "Jupyter Notebook", "license": "MIT", "license_family": "permissive", "maturity": "abandoned", "member_repos": ["microsoft/Microsoft-365-Defender-Hunting-Queries"], "name": "microsoft/Microsoft-365-Defender-Hunting-Queries", "platform": ["cloud", "self-hosted"], "pushed_at": "2022-02-17T08:59:26+00:00", "repo": "microsoft/Microsoft-365-Defender-Hunting-Queries", "stars": 2087, "tags": ["threat-hunting", "kusto-queries", "microsoft-365-defender", "deprecated", "sample-queries", "siem"], "topics": ["hunting", "cybersecurity", "sample-code"], "urls": [], "use_cases": ["find kql queries to hunt for threats in microsoft 365 defender", "learn advanced hunting query syntax for defender", "detect suspicious activity in m365 telemetry with ready-made queries", "get example hunting queries for a security operations team", "bootstrap threat hunting queries for microsoft sentinel"], "what_it_is": "A collection of sample Kusto Query Language (KQL) hunting queries for Microsoft 365 Defender's Advanced Hunting feature, contributed by Microsoft and the community. The repository is deprecated and its content has moved to the unified Microsoft Sentinel / Microsoft 365 Defender community repo (Azure/Azure-Sentinel).", "when_to_avoid": ["you want actively maintained queries - use the Azure/Azure-Sentinel community repo instead", "you need hunting queries for non-Microsoft security products", "you expect new releases or updates - this repo is deprecated"], "when_to_choose": ["you need reference KQL hunting queries for Microsoft 365 Defender or Sentinel", "you want to learn advanced hunting query patterns from real examples"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/microsoft-365-defender-hunting-queries", "repo": "microsoft/Microsoft-365-Defender-Hunting-Queries", "role": "main", "score": 10}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:12.039189+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:55:45.743893+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "03a480aa0de3daee755c5c57d3104ccc8875c4a6f2c408c4e9bf6411f2eccd41", "fetched_at": "2026-08-28T04:06:12.039189+00:00", "kind": "readme", "missing": false, "url": "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["archived"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3090, "days_push": 1658, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 10, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}