AuditLogs
Search and discover KQL queries for Microsoft Sentinel, Defender, and Azure Monitor
Our Sponsors
ExposureGraphEdges
Entra ID Privileged Role Membership Inventory Via Exposure Graph
AgentsInfoExposureGraphNodesCloudAppEvents
Hunt Local AI Agent Activity With Agent Info
AgentsInfoCloudAppEvents
Hunt AI Agent Activity With Agent Info
AgentsInfoIdentityInfo
Orphaned Security Agent Detection
CommonSecurityLog
Outbound Upload From Internal Host
IdentityInfoSigninLogs
Adminsignsinfronnewnetwork
CommonSecurityLogSigninLogsAzureActivity
Possible Malware Activity
DeviceLogonEvents
Anomalous Increase In Unique Device Logon Count Per User
IdentityInfo
Potential Entra Admin Synced Back On Premise
DeviceInfoDeviceProcessEvents
MDE Schedulted Tasks
IdentityInfoSigninLogs
Privileged Account Authentication Method Audit
DeviceProcessEvents
Linux Pedit COW Exploit Detection CVE 2026 46331
AADUserRiskEventsEntraIdSignInEventsIdentityInfo
User Risk Event Correlation With Historical Baseline
AADUserRiskEventsEntraIdSignInEventsIdentityInfo
User Risk Event Correlation With Historical Baseline And Account Age
DeviceProcessEventsDeviceRegistryEvents
Unofficial Win Get Source Added
DeviceFileEvents
Executable Files Program Data Folder
DeviceFileEvents
Executable Files Public Folder
DeviceFileEventsDeviceProcessEvents
Suspicious Oahd Activity On Mac OS
IdentityQueryEvents
Unusual LDAP Query Burst From New Or Known Device
IdentityQueryEvents
LDAP Cross Domain Enumeration
DeviceInfoDeviceNetworkEventsThreatIntelligenceIndicator
MDE Internet Facing
AgentsInfo
MDE Local AI Agents
IdentityQueryEventsIdentityLogonEvents
Correlating LDAP Reconnaissance With Kerberoasting And Sensitive Queries
DeviceProcessEvents
Mac OS Keychain Dump Via Security CLI
DeviceProcessEvents
Suspicious Tool Accessing Browser Cookies On Mac OS
DeviceTvmSecureConfigurationAssessment
Device Tvm Secure Configuration Assessment Enrichment With SCID Details
AuditLogs
30 PIM Self Activation Tier0role
ExposureGraphNodes
Windows Workstations With RDP Enabled And Allowed Connections
ExposureGraphNodes
High Risk Vulnerabilities With Exploits Detected On Onboarded Devices
ADOAuditLogs_CL
Azure Dev Ops High Volume Search Activity
IdentityLogonEvents
Masking Account Names And UP Ns For Demos
DeviceNetworkEventsDeviceImageLoadEvents
Multiple Uncommon Loaded Image Connection To Suspicious Domain
DeviceNetworkEvents
Outbound Connection To Spydisec High Confidence Malicious IP
SecurityAlertSecurityIncidentSentinelHealth+1
Sentinel Rule Tuning Queries
DeviceInfoDeviceTvmSoftwareInventory
Identify Windows Devices Missing Defender For Endpoint WSL Plugin
AADRiskyServicePrincipalsExposureGraphEdgesExposureGraphNodes+2
Workload Identity Info Xdr
AADServicePrincipalSignInLogs
21 Service Principal Anomalous IP Spread
AADNonInteractiveUserSignInLogsOfficeActivity
14 NI Auth Bulk Data Download
AADNonInteractiveUserSignInLogsAuditLogs
10 Stale Token After Password Change
DeviceNetworkEvents
Device Network Events Uncommon Process Connection To Suspicious Domain
DeviceFileEvents
Detect Shebang Code Inside Files With Unusual Extensions
DeviceFileEvents
Detect Shebang Code Inside Device Files
DeviceFileEventsEmailAttachmentInfo