This repository contains various Sentinel/Log Analytics KQL queries that I’ve created for different tasks and projects. More will be added as and when I create them.
- SentinelHealth - Queries for monitoring
Sentinel health. For example, data connectors. - SigninLogs - Queries for investigating sign-in activity using the
SigninLogstable. Useful for detecting suspicious logins, failed attempts, and geographic anomalies, etc.
If you'd prefer to pass all of the queries in this repo to a LLM or AI tool like Claude or ChatGPT, you can download the repository_context.md file. It's an auto-generated merged representation of all of the KQL queries within this repo.