reprise99/Sentinel-Queries resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1645 stars · 382 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated collection of KQL (Kusto Query Language) queries, tips, and tutorials for Microsoft Sentinel. It teaches how to write queries for threat hunting, detections, and anomaly analysis across Sentinel, Azure Monitor, and Log Analytics.

Use cases

• learn KQL for Microsoft Sentinel
• find threat hunting queries for Azure sign-in logs
• write detection queries for security incidents
• query Azure AD sign-in logs for anomalies
• learn KQL where, project, and summarize operators
• build SIEM detection rules with KQL

When to choose

• you use Microsoft Sentinel or Azure Log Analytics and need example KQL queries
• you are learning KQL syntax from basics to advanced
• you need ready-made queries for threat hunting or detections

When to avoid

• you use a SIEM other than Microsoft Sentinel
• you need a runnable tool or application rather than query examples
• you work with non-Azure log sources

Facets

learning-resource · maturity active

search-engine monitoring security developer-tools security developer-tools tutorials monitoring cloud self-hosted kql microsoft-sentinel siem threat-hunting query-collection azure

Member repositories

For agents

markdown · JSON · MCP: product_card(name="reprise99/Sentinel-Queries")