Skip to content
BranchesTags

Latest commit

 

History

18 Commits

Folders and files

NameName
Last commit message
Last commit date
CountCVEbySeverity.kql
CountCVEbySeverity.kql
 
 
DailyIoCsHASHES.kql
DailyIoCsHASHES.kql
 
 
DailyIoCsIPs.kql
DailyIoCsIPs.kql
 
 
DailyIoCsURLs.kql
DailyIoCsURLs.kql
 
 
DiskPaths_SoftwareInventory.kql
DiskPaths_SoftwareInventory.kql
 
 
InternetFacingVuln.kql
InternetFacingVuln.kql
 
 
OnboardedDevices.kql
OnboardedDevices.kql
 
 
README.md
README.md
 
 
SCIDsRefSheet.kql
SCIDsRefSheet.kql
 
 
SoftwareInventoryByDeviceName.kql
SoftwareInventoryByDeviceName.kql
 
 
VulnReporting_CVEKB.kql
VulnReporting_CVEKB.kql
 
 
VulnReporting_CVEListPerDevice.kql
VulnReporting_CVEListPerDevice.kql
 
 
VulnReporting_CountByDeviceName.kql
VulnReporting_CountByDeviceName.kql
 
 
VulnReporting_Weaknesses.kql
VulnReporting_Weaknesses.kql
 
 
affectedDeviceListbyCVEID.kql
affectedDeviceListbyCVEID.kql
 
 

Repository files navigation

KQL Threat Hunting

You can use and run those shared queries in Defender XDR/EDR to find any correlated events with IoCs extracted from threat feeds, export vulnerability reports and so on.

About

In this repository, you will find KQL queries that can be executed in Defender EDR.

Topics

kql-querieskql-threathunting

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

1 fork
Report repository

Releases

Packages

Contributors