{"adoption": {"forks": 382, "observed_at": "2026-08-28T04:05:16.232562+00:00", "stars": 1645}, "canonical_url": "https://ross.abutalabs.com/products/sentinel-queries", "card": {"archived": false, "artifact_type": "learning-resource", "description": "Collection of KQL queries", "domain": ["security", "developer-tools", "tutorials", "monitoring"], "enriched": true, "function": ["search-engine", "monitoring", "security", "developer-tools"], "health_score": 59, "homepage": null, "language": null, "license": "MIT", "license_family": "permissive", "maturity": "active", "member_repos": ["reprise99/Sentinel-Queries"], "name": "reprise99/Sentinel-Queries", "platform": ["cloud", "self-hosted"], "pushed_at": "2026-01-29T01:28:08+00:00", "repo": "reprise99/Sentinel-Queries", "stars": 1645, "tags": ["kql", "microsoft-sentinel", "siem", "threat-hunting", "query-collection", "azure"], "topics": [], "urls": [], "use_cases": ["learn KQL for Microsoft Sentinel", "find threat hunting queries for Azure sign-in logs", "write detection queries for security incidents", "query Azure AD sign-in logs for anomalies", "learn KQL where, project, and summarize operators", "build SIEM detection rules with KQL"], "what_it_is": "A curated collection of KQL (Kusto Query Language) queries, tips, and tutorials for Microsoft Sentinel. It teaches how to write queries for threat hunting, detections, and anomaly analysis across Sentinel, Azure Monitor, and Log Analytics.", "when_to_avoid": ["you use a SIEM other than Microsoft Sentinel", "you need a runnable tool or application rather than query examples", "you work with non-Azure log sources"], "when_to_choose": ["you use Microsoft Sentinel or Azure Log Analytics and need example KQL queries", "you are learning KQL syntax from basics to advanced", "you need ready-made queries for threat hunting or detections"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/sentinel-queries", "repo": "reprise99/Sentinel-Queries", "role": "main", "score": 61}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:05:16.232562+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T03:45:25.783277+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "02ee6aae642d05f5562ac92c182ec586b3192240603402cea02fa2311555b5e0", "fetched_at": "2026-08-28T04:05:16.232562+00:00", "kind": "readme", "missing": false, "url": "https://github.com/reprise99/Sentinel-Queries"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 64, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_releases"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1851, "days_push": 217, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 61, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}