Pinned Loading

1. Hunting-Queries-Detection-Rules Hunting-Queries-Detection-Rules Public

   KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

   Python 1.8k 327

2. Open-Source-Threat-Intel-Feeds Open-Source-Threat-Intel-Feeds Public

   This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

   Python 948 100

3. Incident-Response-Powershell Incident-Response-Powershell Public

   PowerShell Digital Forensics & Incident Response Scripts.

   PowerShell 815 118

4. Sentinel-Automation Sentinel-Automation Public

   Sentinel Logic Apps, Playbooks and Workbooks to automate enrichment, incident analysis and more.

   124 21

5. KustoHawk KustoHawk Public

   KustoHawk is a lightweight incident triage and response tool designed for effective incident response in Microsoft Defender XDR and Microsoft Sentinel environments.

   PowerShell 159 24

6. EntraTrace EntraTrace Public

   EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra ID.

   Python 54 7