edoardogerosa/sentinel-attack resource

Health v2 · maintenance only

Adoption not part of the score

1077 stars · 201 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A toolkit for rapidly deploying a threat hunting capability on Azure Sentinel using Sysmon telemetry mapped to the MITRE ATT&CK framework. It includes a Sysmon KQL log parser aligned with the OSSEM data model plus Terraform-based deployment resources.

Use cases

• deploy threat hunting on azure sentinel
• parse sysmon logs in sentinel
• map sysmon events to mitre att&ck
• set up siem detection rules with kql
• build azure sentinel workbooks for threat hunting
• ingest sysmon telemetry into azure log analytics

When to choose

• you use Azure Sentinel and want a fast Sysmon-based hunting setup
• you want detections aligned to MITRE ATT&CK and OSSEM
• you need a ready-made KQL Sysmon parser function

When to avoid

• you use a SIEM other than Azure Sentinel
• you need a production-ready solution without tuning
• you don't collect Sysmon event logs

Facets

infra-config · maturity maintenance

logging monitoring security deployment infrastructure-as-code security cloud-computing cloud self-hosted windows siem azure-sentinel mitre-attack sysmon threat-hunting kql blue-team detection devops

Member repositories

For agents

markdown · JSON · MCP: product_card(name="edoardogerosa/sentinel-attack")