This query is designed to help identify and analyze processes in a system that have taken the longest time to complete. Here's a simple breakdown of what it does:

1. **Selects Data**: It looks at the "Process" data and selects specific information: the name of the process, when it started, and its duration in both milliseconds and minutes.

2. **Calculates Duration**: It converts the process duration from milliseconds to minutes for easier interpretation.

3. **Filters Data**: It only considers processes that have a measurable duration, meaning they have started and have a positive elapsed time.

4. **Sorts Data**: It organizes the processes in descending order based on their duration in minutes, so the processes that took the longest time appear at the top.

This helps in identifying which processes might need optimization due to their long execution times.

Analyze Start Times and Run Durations of Processes.kql

This query is designed to extract specific details about the CPU from a dataset. It focuses on gathering three key pieces of information: the type of processor, the designation of the socket it uses, and the width of the address bus. This information is useful when considering hardware upgrades or checking if components are compatible with each other.

Assess CPU Physical Characteristics.kql

The query is looking for security events in the Windows Event log that occurred within the last 7 days. It specifically filters for events that contain the message "primary token was assigned". The purpose is to monitor for any potential unauthorized privilege escalations or access attempts.

Assigned Primary Tokens.kql

This query is designed to retrieve and display information related to the BIOS (Basic Input/Output System) of a computer. It accesses a data source named `BiosInfo` and selects specific columns to show. The output will include the following details for each entry:

- **Manufacturer**: The company or entity that produced the BIOS.
- **ReleaseDateTime**: The date and time when the BIOS was released.
- **SerialNumber**: A unique identifier assigned to the BIOS.
- **SmBiosVersion**: The version of the System Management BIOS (SMBIOS) standard that the BIOS adheres to.

In simple terms, this query lists key details about the BIOS from a dataset, focusing on who made it, when it was released, its unique serial number, and its SMBIOS version.

BIOS Details.kql

The query is looking for recent critical system errors with Event ID 1001 in the Windows Event Viewer within the last 7 days.

Blue Screen of Death.kql

This query is designed to identify SSL certificates that are set to expire within the next 90 days. It works by:

1. Accessing a database or table named "Certificate" that contains information about SSL certificates.
2. Selecting specific columns of interest: `SubjectName`, `ValidFromDateTime`, `ValidToDateTime`, and `CommonName`.
3. Filtering the results to include only those certificates whose expiration date (`ValidToDateTime`) is in the future but within the next 90 days from the current date and time.
   
In simple terms, this query helps you find SSL certificates that need to be renewed soon, allowing you to take action before they expire.

Certificates That Will Expire in the Next 90 days.kql

The query is looking for Windows events in the 'Application' category that occurred within the last 7 days. It then filters the events to only include those where the message is 'Machine restart is required'. This query is used for monitoring and alerting on systems that need to be restarted due to recent application installations or updates.

Check if Device Restart Is Required.kql

This query is designed to check if TPM (Trusted Platform Module) version 2.0 is available. It does this by searching through a dataset named `Tpm` and filtering the results to only include entries where the `SpecVersion` field contains the text '2.0'. Essentially, it's looking for any records that indicate the presence of TPM version 2.0.

Check if TPM 2.0 is available.kql

This query is designed to monitor and analyze processes running on a computer to help identify potential security threats or performance issues. Here's a simple breakdown of what it does:

1. **Data Source**: It starts by looking at a dataset called `Process`, which contains information about processes running on a computer.

2. **Select Columns**: It selects three specific pieces of information for each process:
   - `ProcessName`: The name of the process.
   - `CommandLine`: The command line used to start the process.
   - `StartDateTime`: The date and time when the process started.

3. **Filter**: It filters out any processes where the `CommandLine` is either empty or null, meaning it only keeps records where there is a valid command line entry.

4. **Sort**: Finally, it sorts the remaining processes first by `ProcessName` and then by `StartDateTime`, organizing them in alphabetical order by process name and chronological order by start time.

Overall, this query helps in reviewing and investigating the processes that have valid command lines, making it easier to spot unusual or suspicious activities.

Command Lines Used to Start Processes.kql

This query is designed to check if a CPU is being overclocked by comparing its current clock speed to its maximum clock speed. It looks at data from a table named `Cpu` and selects the columns `ProcessorId`, `CurrentClockSpeed`, and `MaxClockSpeed`. Additionally, it creates a new column called `Overclocked` that indicates whether the CPU is overclocked. If the current clock speed is greater than the maximum clock speed, the `Overclocked` column will display 'Yes'; otherwise, it will display 'No'.

Detect CPU Overclocking.kql

This query is designed to monitor and identify processes on a system that are using a lot of disk input/output (I/O) resources. Specifically, it looks for processes that have read from or written to the disk more than 10 megabytes (MB). Here's a simple breakdown of what the query does:

1. **Filter Processes**: It selects processes where either the amount of data read from the disk or the amount of data written to the disk is greater than 10 MB.

2. **Select Information**: For these processes, it retrieves and displays the following details:
   - `ProcessId`: The unique identifier for the process.
   - `ProcessName`: The name of the process.
   - `Path`: The file path of the process.
   - `DiskBytesReadMB`: The amount of data read from the disk, converted to megabytes.
   - `DiskBytesWrittenMB`: The amount of data written to the disk, converted to megabytes.

3. **Order Results**: It sorts the results in descending order based on the amount of data written to the disk (in MB).

This helps in identifying which processes are using the most disk resources, allowing for optimization of resource usage.

Detect Processes That Are Reading or Writing Significantly to Disk.kql

This query is designed to help identify and analyze the unique processes that have been executed by Windows user accounts. Here's a simple breakdown of what it does:

1. **Selects Specific Data**: It focuses on four key pieces of information from the `Process` data: the Windows user account, the process name, the process ID, and the command line used to start the process.

2. **Filters for Uniqueness**: It ensures that each combination of user account, process name, process ID, and command line is unique. This means it removes any duplicate entries from the results.

3. **Sorts the Results**: Finally, it organizes the data by sorting it first by the Windows user account and then by the process name.

Overall, this query helps in auditing or security analysis by providing a clear and organized view of the distinct processes run by each user on a Windows system.

Determine Which Users Are Running Which Processes.kql

The query is used to retrieve security event logs from the Windows Event Viewer. It specifically looks for events with ID 1102, which indicates the clearing of security logs. The query is limited to events that occurred within the past 7 days.

Event Log was Cleared.kql

The query is looking for failed login attempts on Windows systems within the last 7 days. It filters the results to only include events with an EventId of 4625, which typically indicates a failed login attempt. This query is useful for security analysis and detecting potential breaches.

Failed User Account Login.kql

This query is designed to search through system logs to find processes that are related to security. Specifically, it looks for any process whose name includes the words 'Defender', 'Sense', or 'Security'. This helps in identifying and monitoring security-related activities within the system.

Find All System Processes Related to Defender, Sense or Security.kql

This query is designed to find devices where BitLocker encryption is not turned on for the C: drive. It looks at a table called `EncryptableVolume` and filters for entries where the drive letter is "C:" and the protection status is not "PROTECTED." The query then displays the device name, drive letter, protection status, encryption method, and the percentage of the drive that is encrypted.

Find Devices with BitLocker Not Enabled.kql

This query is designed to find devices that have multiple physical disks. Here's a simple breakdown of what it does:

1. **Data Source**: It starts with a table or dataset called `DiskDrive`, which contains information about physical disks on various devices.

2. **Summarize**: It groups the data by each device and counts the number of physical disks associated with each device. This is done using the `summarize` function, which creates a new column called `DiskCount` that holds the count of disks for each device.

3. **Filter**: It then filters the results to only include devices that have more than one disk. This is achieved with the `where` clause, which specifies that only devices with a `DiskCount` greater than 1 should be included in the final output.

In summary, the query lists all devices that have more than one physical disk attached to them.

Find Devices with Multiple Physical Disks.kql

This query is designed to retrieve and display all available information about physical disk drives from a data source or database. The `DiskDrive` part suggests that the query is targeting a table or dataset specifically related to physical disk drives. In simple terms, this query is asking for a comprehensive list of details about each physical disk drive in the system or database being queried.

Find Disk Information.kql

This query is designed to identify Windows drivers on a system that do not have an associated INF (Information) file. In simple terms, it searches through a database of Windows drivers and filters out those entries where the INF file name is missing or not specified. The result will be a list of drivers that lack this important file, which is typically used for driver installation and configuration.

Find Drivers That Don’t Have Associated Inf Files.kql

This query is designed to analyze processes based on their memory usage to help identify applications that use a lot of memory, which can then be optimized or troubleshooted. Here's a breakdown of what it does:

1. **Data Source**: It starts by looking at data from a table or dataset called `Process`, which contains information about different processes running on a system.

2. **Calculate Memory Usage**: For each process, it calculates three key statistics related to memory usage:
   - **Average Memory Usage (AvgMemoryUsageBytes)**: The average amount of memory used by the process.
   - **Maximum Memory Usage (MaxMemoryUsageBytes)**: The highest amount of memory used by the process at any point.
   - **Minimum Memory Usage (MinMemoryUsageBytes)**: The lowest amount of memory used by the process.

3. **Group by Process**: These calculations are grouped by the name of the process (`ProcessName`), so you get these statistics for each individual process.

4. **Order Results**: The results are then sorted in descending order based on the average memory usage. This means the processes that use the most memory on average will appear at the top of the list.

5. **Select Columns**: Finally, it selects and displays only the process name and the calculated memory usage statistics (average, maximum, and minimum).

In simple terms, this query helps you find out which processes are using the most memory on average, so you can focus on those that might need optimization or troubleshooting.

Find Processes With High Memory Usage.kql

This query is designed to help identify processes on a system that might be using an unusually high number of threads or handles, which can be useful for performance analysis and optimization. Here's a simple breakdown of what the query does:

1. **Data Source**: It starts by looking at data from a table or dataset named `Process`, which contains information about running processes.

2. **Filter Criteria**: It filters the processes to find those that have more than 100 threads or more than 1000 handles. These thresholds are set to identify processes that might be consuming more resources than usual.

3. **Select Information**: For each of these processes, it selects (or "projects") specific pieces of information: the name of the process (`ProcessName`), its ID (`ProcessId`), the number of threads it is using (`ThreadCount`), the number of handles it is using (`HandleCount`), and the file path where the process is located (`Path`).

4. **Order Results**: Finally, it orders the results by the number of threads in descending order, and if there are ties, by the number of handles also in descending order. This means the processes with the highest thread counts will appear first in the results.

Overall, this query helps in quickly identifying and examining processes that might be impacting system performance due to high resource usage.

Find Processes With Unusually High Thread or Handle Counts.kql

The query checks if TPM 2.0 is available by filtering the Tpm table to only include entries where the SpecVersion contains '2.0'.

Find Windows 11 Compatible Tpms.kql

This query is designed to find processes on a system that are using an unusually large amount of virtual memory compared to their physical memory usage. Here's a breakdown of what it does:

1. **Filter Processes**: It looks at all running processes and filters out those where the total virtual memory size (`TotalSizeBytes`) is more than ten times the size of the physical memory currently being used (`WorkingSetSizeBytes`).

2. **Select Information**: For the processes that meet this condition, it selects and displays the following details:
   - `ProcessName`: The name of the process.
   - `ProcessId`: The unique identifier for the process.
   - `WorkingSetSizeBytes`: The amount of physical memory the process is using.
   - `TotalSizeBytes`: The total virtual memory size allocated to the process.

3. **Order Results**: It sorts the results in descending order based on the total virtual memory size (`TotalSizeBytes`), so the processes using the most virtual memory appear first.

In simple terms, this query helps identify processes that might be inefficiently using system resources by having a large virtual memory footprint compared to their actual physical memory usage.

Flag Processes With Disproportionately Large Virtual Memory Usage.kql

This query is designed to analyze Windows system event logs to identify which driver providers appear most frequently. It does this by counting the number of times each driver provider is mentioned in the logs. The result is a list of driver providers along with the number of times each one is recorded, allowing you to see which providers are most common in the system's event logs.

Group Drivers by Their Provider Name.kql

This query is analyzing data about devices and is focused on understanding the variety of CPU architectures present. It does this by counting how many devices there are for each combination of CPU architecture, manufacturer, and model. The result will show you how many devices exist for each specific architecture-manufacturer-model trio.

Identify CPU Architecture Distribution.kql

This query is designed to retrieve specific details about a computer's CPU from a dataset named "Cpu." It focuses on extracting three key pieces of information: 

1. **Architecture**: The type of CPU architecture (e.g., x86, x64, ARM).
2. **CoreCount**: The number of physical cores in the CPU.
3. **LogicalProcessorCount**: The total number of logical processors, which includes both physical cores and any additional virtual cores created through technologies like hyper-threading.

The purpose of this query is to help understand the computing power and capabilities of a device by examining these CPU characteristics.

Identify CPU Configuration.kql

This query is designed to find devices that have a BIOS release date older than one year. It does this by:

1. Accessing the `BiosInfo` data table.
2. Filtering the records to include only those where the `ReleaseDateTime` (the date the BIOS was released) is more than 365 days ago.
3. Displaying the results with specific details: the `Device` name, `Manufacturer`, `SmBiosVersion`, and the `ReleaseDateTime`.

Identify Devices with Outdated BIOS.kql

This query is designed to help identify and prioritize processes that are using a significant amount of disk space for their working set, which can be important for optimizing system resources. Here's a simple breakdown of what the query does:

1. **Filter Processes**: It starts by selecting processes that are currently using disk space (`OnDisk == true`).

2. **Select and Rename Columns**: It then chooses specific information to display for each process:
   - `ProcessName`: The name of the process.
   - `Path`: The file path of the process.
   - `WorkingSetSizeMB`: The working set size of the process, converted from bytes to megabytes for easier readability.
   - `OnDisk`: A confirmation that the process is using disk space.

3. **Sort the Results**: Finally, it orders the list of processes by their working set size in megabytes, from largest to smallest, so that the processes using the most disk space appear at the top.

In summary, this query helps you quickly identify which processes are consuming the most disk space, allowing you to focus on optimizing those that have the highest impact on system resources.

Identify Processes That Are Heavily Using Disk Space.kql

This query is designed to help identify programs that are configured to automatically run when a Windows system starts up. It looks into a specific part of the Windows Registry, which is a database that stores settings and options for the operating system. The query specifically examines the "Run" section under "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" in the registry. 

The query retrieves and displays four pieces of information for each entry found in this section:
1. **RegistryKey**: The path in the registry where the entry is located.
2. **ValueName**: The name of the entry, which typically represents the program or service.
3. **ValueType**: The type of data stored in the entry (e.g., string, binary).
4. **ValueData**: The actual data or command that is executed at startup.

This information is useful for system analysis and security auditing, as it helps identify which programs are set to launch automatically when the computer boots up, potentially highlighting unwanted or malicious software.

Identify Programs Set to Auto-Run at Startup.kql

This query is designed to identify and prioritize processes that are using a large amount of disk resources, specifically focusing on those with high on-disk working set sizes. Here's a simple breakdown of what it does:

1. **Filter Processes**: It looks at processes that have read or written more than 50,000,000 bytes to disk.
2. **Select Information**: For these processes, it selects and displays the process name, process ID, and the amount of data read from and written to the disk.
3. **Order Processes**: It sorts the processes in descending order, first by the amount of data read from the disk and then by the amount of data written.
4. **Limit Results**: Finally, it shows the top 5 processes based on this sorting.

In summary, the query helps in identifying the top 5 processes that are using the most disk resources, which can be useful for optimizing system performance.

Identify Top Disk IO Processes.kql

This query is designed to identify and analyze non-system processes running on a Windows computer. Here's a simple breakdown of what it does:

1. **Filter Processes**: It filters out processes that are located in common system directories such as:
   - `C:\Windows\`
   - `C:\Program Files\`
   - `C:\Program Files (x86)\`
   - `C:\Users\`

   This means it only includes processes that are not running from these standard system or user directories, potentially highlighting unusual or non-standard processes.

2. **Select Specific Information**: It selects (or "projects") only the following details about each process:
   - `ProcessId`: The unique identifier for the process.
   - `ProcessName`: The name of the process.
   - `Path`: The file path from which the process is running.

3. **Sort the Results**: Finally, it sorts the list of processes alphabetically by the `ProcessName`.

In summary, this query helps in identifying and examining processes that are not running from typical system directories, which could be useful for security analysis or troubleshooting.

Identify Unexpected or Unknown Processes Running From Unusual Paths.kql

This query is designed to help identify processes on a system that have been running for a long time and are using a lot of resources. Here's a simple breakdown of what it does:

1. **Selects Information**: It looks at processes and selects specific details about them, including their name, when they started, how long they've been running (in minutes), and how many threads and handles they are using.

2. **Calculates Elapsed Time**: It converts the elapsed time from milliseconds to minutes for easier understanding.

3. **Filters Processes**: It only considers processes that have been running for some time (more than 0 minutes).

4. **Orders Results**: It sorts the processes, showing the ones that have been running the longest first. If two processes have been running for the same amount of time, it further sorts them by the number of threads and handles they are using, in descending order.

Overall, this query helps in identifying which processes might be impacting system performance due to their long runtime and high resource usage.

Impact of Processes Over Time by Looking at How Long They Run.kql

This query is designed to help manage and monitor certificates related to Intune, a Microsoft service for mobile device and application management. It searches through a dataset of certificates and filters the results to only include those certificates whose "CommonName" field contains the word "Intune". Essentially, it retrieves a list of all certificates associated with Intune.

Intune MDM Device Certificate.kql

This query is designed to identify and extract information about certificate authorities from a dataset named "Certificate." Here's a simple breakdown of what it does:

1. **Filter for Certificate Authorities**: It selects only those entries where the `IsCa` field is `true`, meaning it filters the dataset to include only certificate authorities.

2. **Select Specific Columns**: From the filtered results, it extracts and displays three specific pieces of information: 
   - `IsCa`: A field indicating whether the entry is a certificate authority (which will always be `true` in this case).
   - `CommonName`: The common name associated with the certificate authority.
   - `SubjectName`: The subject name associated with the certificate authority.

In summary, this query is used to find and list the common and subject names of certificate authorities from the dataset.

List All CA Certificates.kql

This query is designed to help with security auditing or detecting unusual activities by focusing on processes that are started by system accounts. Here's a simple breakdown of what it does:

1. **Data Source**: It looks at a dataset called "Process," which contains information about various processes running on a system.

2. **Filter**: It specifically filters out processes that are initiated by system accounts. These accounts are identified by their usernames starting with "NT AUTHORITY."

3. **Select Information**: For each of these processes, it selects and displays the following details:
   - `ProcessId`: The unique identifier for the process.
   - `ProcessName`: The name of the process.
   - `Path`: The file path where the process is located.
   - `CommandLine`: The command line used to start the process.
   - `WindowsUserAccount`: The account name that started the process.
   - `StartDateTime`: The date and time when the process was started.

In summary, this query helps identify and examine processes that are started by system-level accounts, which can be useful for monitoring and detecting potential security issues.

List All Process That Running Under NT Authority.kql

This query is designed to monitor and troubleshoot application failures in Windows environments. It retrieves data from a table or dataset named `WindowsAppCrashEvent`, which likely contains logs or records of application crashes on Windows systems. By analyzing this data, you can identify patterns, diagnose issues, and take corrective actions to improve application stability and performance.

List of Applications Crashes.kql

This query is designed to extract information from the Windows Registry, specifically targeting all entries under the "HKEY_LOCAL_MACHINE\SOFTWARE" path. The purpose of this query is to gather details about software-related configurations and settings on a Windows system. This information can be used for auditing the system or creating an inventory of installed software. Essentially, it helps in understanding what software is configured on the machine and how it is set up.

Lookup Registry Keys Wildcard.kql

This query is designed to retrieve information about the CPU's performance. It specifically looks at three key pieces of data:

1. **CurrentClockSpeed**: The current operating speed of the CPU.
2. **MaxClockSpeed**: The maximum speed the CPU is capable of reaching.
3. **CpuStatus**: The current status of the CPU, which can indicate if it's functioning normally or experiencing issues like throttling.

By examining these details, you can determine if the CPU is running at its expected performance level or if there are any potential problems affecting its speed.

Monitor CPU Performance and Health.kql

This KQL query is designed to retrieve information about the "hosts" file located at "C:\Windows\System32\drivers\etc\hosts" on a Windows system. The "hosts" file is important because it can be used to control DNS resolution, which means it can redirect network traffic or block software updates if altered.

The query specifically extracts and displays the following details about the "hosts" file:
- **Path**: The location of the file on the system.
- **FileName**: The name of the file.
- **SizeBytes**: The size of the file in bytes.
- **LastModifiedDateTime**: The date and time when the file was last modified.
- **Attributes**: The file attributes, which may include information like whether the file is read-only, hidden, or a system file.

In simple terms, this query helps you monitor and check the status of the "hosts" file to ensure it hasn't been tampered with, which could affect network operations or software updates.

Monitor Hosts File.kql

This query is designed to identify which processes are running most frequently on a system. Here's a simple breakdown of what it does:

1. **Data Source**: It starts by looking at a table or dataset called `Process`, which likely contains information about processes running on a system.

2. **Count Processes**: It counts how many times each process appears in the dataset. This is done using the `summarize` function, which groups the data by `ProcessName` and calculates the total number of occurrences for each process.

3. **Order Results**: It then orders the results by the count of occurrences, so you can see which processes are running most frequently.

In summary, this query helps you understand which processes are most active on a system, which can be useful for performance analysis or optimization.

Most frequently running Processes.kql

The query is used to monitor how often certain events occur in an application over the past week. It summarizes the count of events by the name of the provider. This helps identify any patterns or unusual behavior in the software.

Number of Events per Provider.kql

This query is designed to monitor and analyze the distribution of signed versus unsigned drivers in a Windows environment. Here's a simple breakdown of what it does:

1. **Data Source**: It starts by accessing the `WindowsDriver` table, which contains information about drivers installed on Windows systems.

2. **Summarization**: The query uses the `summarize` operator to aggregate data. It counts the total number of drivers and groups them based on whether they are signed or unsigned.

3. **Output**: The result will show two columns: one for the `Signed` status (indicating whether a driver is signed or not) and another for the `Count`, which shows the number of drivers in each category.

In essence, this query provides a simple count of how many drivers are signed versus unsigned in the Windows environment being monitored.

Number of Signed and Unsigned Drivers.kql

This query is designed to find BIOS versions that are older than one year. It does this by looking at a data source called `BiosInfo` and filtering out entries where the `ReleaseDateTime` (the date when the BIOS was released) is more than 365 days ago. After filtering, it selects and displays three pieces of information for each of these older BIOS versions: the `Manufacturer`, the `SmBiosVersion` (the version of the BIOS), and the `ReleaseDateTime`.

Old BIOS Versions.kql

This query is used to monitor the frequency of application-level events on Windows systems. It looks at events from the 'Application' log over the past hour and summarizes the count of events by their severity level.

Overview Event Level Types for Windows Applications Events.kql

This query is used to monitor and analyze service start events on a Windows system within the last hour. It specifically looks for events with ID 3, which indicate that a service has started. The results are then ordered by the time they were logged, with the most recent events appearing first.

Query Recent Windows System Event Logs.kql

This query is designed to search for files located in the `C:\Windows\` directory on a computer. It retrieves information about these files and sorts them in descending order based on their creation date and time. In simple terms, it lists the most recently created files in the `C:\Windows\` folder, showing the newest files at the top of the list.

Search Recently Created Files at a Location.kql

The query is looking for instances of Service Control Manager events on Windows systems where a service failed to start within the past 7 days. It specifically focuses on events with Event ID 7000.

Service Start Failure.kql

The query retrieves all application-related events from the Windows Event Log that occurred within the last day. It is used to quickly review these events for troubleshooting a reported issue.

Show All Application Events.kql

This query is designed to help monitor and ensure the security of SSL certificates across various store locations. It does this by retrieving and displaying specific information about each certificate, focusing on three key details: the location of the store where the certificate is used (`StoreLocation`), the common name associated with the certificate (`CommonName`), and the subject name of the certificate (`SubjectName`). Essentially, it provides a straightforward way to track and review SSL certificates by these attributes to ensure they are correctly configured and secure.

Show All Certificates That Are Not Stored in Localmachine.kql

This query is designed to help identify unsigned drivers on a Windows operating system, which is important for security auditing and compliance purposes. In simple terms, it looks through a list of Windows drivers and filters out those that are not signed. A signed driver is one that has been verified by a trusted source, ensuring its authenticity and integrity. By identifying unsigned drivers, you can pinpoint potential security risks, as these drivers may not have been properly vetted and could pose a threat to the system.

Show All Drivers That Are Not Signed.kql

This query is designed to help identify digital certificates that may be outdated or insecure due to their use of weak hashing algorithms, specifically SHA-1 or MD5. It searches through a database of certificates and filters out those that use either of these algorithms. The query then displays specific details about these certificates, including:

- **SigningAlgorithm**: The algorithm used to sign the certificate (either SHA-1 or MD5 in this case).
- **SubjectName**: The name of the entity that the certificate is issued to.
- **CommonName**: A more specific identifier within the SubjectName, often used as a domain name.
- **SelfSigned**: Indicates whether the certificate is self-signed or not.

This information is useful for cybersecurity audits to identify certificates that may need to be updated or replaced to ensure security.

Show All Insecure Certificates.kql

This query is designed to retrieve and display a list of all local drives on a Windows PC. It uses the `LogicalDrive` table, which contains information about the logical drives available on the system. Essentially, when you run this query, it will provide you with details about each local drive, such as their names and possibly other attributes, depending on the available data in the `LogicalDrive` table.

Show All Local Drives.kql

This query is designed to retrieve and display all user groups that are locally available on a system, including those that have elevated privileges. The `LocalGroup` table or dataset is being queried to list these groups. Essentially, it's a way to see all the user groups on a local machine, with a focus on identifying any groups that have special or administrative permissions.

Show all Local Groups on Device.kql

This query is designed to find and list self-signed certificates within a network, which can be a potential security risk. Here's a breakdown of what it does:

1. **Certificate**: This is the data table or source that contains information about certificates in the network.

2. **| where SelfSigned == true**: This filters the data to only include certificates that are self-signed. A self-signed certificate is one that is signed by the same entity that it certifies, rather than by a trusted certificate authority.

3. **| project SubjectName, CommonName, SelfSigned**: This selects and displays specific columns from the filtered data. It shows:
   - **SubjectName**: The name of the entity that the certificate is issued to.
   - **CommonName**: A specific field within the certificate that usually contains the domain name or identity the certificate is associated with.
   - **SelfSigned**: A boolean value indicating that the certificate is self-signed.

In simple terms, this query helps identify and list all self-signed certificates in the network, showing who they are issued to and their common names, which can help assess potential security risks.

Show All Self-Signed Certificates.kql

The query is looking for application crashes or errors on Windows systems that have occurred in the past week. It specifically filters for events with an EventId of 1000.

Show Application Crashes.kql

The query is looking for application hang events in Windows systems that have occurred in the past 7 days. It filters the events to only include those with an EventId of 1002.

Show Application Hangs.kql

This query is designed to help identify expired security certificates, which is important for maintaining secure and uninterrupted encrypted communication. Here's a simple breakdown of what the query does:

1. **Certificate**: This is the data source or table that contains information about security certificates.

2. **| where ValidToDateTime < now()**: This part filters the certificates to find those that have expired. It checks if the expiration date (`ValidToDateTime`) is earlier than the current date and time (`now()`).

3. **| project ValidToDateTime, SubjectName, CommonName**: This step selects specific columns to display from the filtered results. It shows the expiration date (`ValidToDateTime`), the subject name (`SubjectName`), and the common name (`CommonName`) of each expired certificate.

In summary, the query lists all expired certificates by showing their expiration date, subject name, and common name, helping to identify potential security risks.

Show Expired Certificates on Device.kql

This query is used to monitor and troubleshoot license activation errors in applications on Windows systems within the last 7 days. It searches for events in the 'Application' log that contain the phrase 'License Activation' in the message and filters for events with an error level.

Show Failed Licence Activations.kql

The query is looking for Windows events related to application installations that have been successfully completed in the last 7 days.

Show Latest Application Installations.kql

The query is looking for service startup events in Windows applications that have occurred within the last 7 days. It filters the events to only include those that have a message containing the phrase "Service started".

Show Services That Have Started.kql

The query is looking for recent shutdowns of application services within the last 7 days in the Windows event logs. It filters the events to only include those where the message contains the phrase 'Service stopped'.

Show Services That Have Stopped.kql

This query is designed to help monitor the security of a website by identifying active SSL/TLS certificates. Here's a simple breakdown of what it does:

1. **Certificate**: This is the data source or table that contains information about SSL/TLS certificates.

2. **where ValidToDateTime > now()**: This filters the certificates to only include those that are still valid, meaning their expiration date (ValidToDateTime) is in the future compared to the current date and time (now()).

3. **project ValidToDateTime, SubjectName, CommonName**: This selects and displays only specific pieces of information from the filtered certificates: 
   - **ValidToDateTime**: The expiration date of the certificate.
   - **SubjectName**: The name of the entity to which the certificate was issued.
   - **CommonName**: The common name associated with the certificate, often the domain name of the website.

In summary, this query helps you keep track of which SSL/TLS certificates are currently valid and provides key details about them to ensure your website remains secure and trustworthy.

Show Valid Certificates on Device.kql

The query is looking for successful logon events in the Windows Security log within the last 7 days. It filters the events to only include those with an EventId of 4624, which typically indicates a successful logon. This is done to monitor for any unauthorized access attempts.

Successful User Account Login.kql

This query is designed to find devices that have an operating system (OS) installed for more than three years and determine how many days have passed since they were last updated with a patch. Here's a breakdown of what it does:

1. **Identify Devices with Old OS Installations**: It looks for devices where the OS was installed more than 1,095 days ago (which is equivalent to three years).

2. **Find the Last Patch Date**: It retrieves the most recent patch installation date for each device.

3. **Calculate Days Since Last Patch**: For each device, it calculates the number of days that have passed since the last patch was installed.

4. **Output**: The query outputs a list of devices, including their OS name, installation date, the date of the last patch, and the number of days since the last patch was applied.

System Age and Update Status Analysis.kql

The query is looking for instances of system time changes in the security logs of Windows events that have occurred within the last 7 days. It filters the results to only include events with the EventId of 4616.

System Time Changed.kql

This query is designed to monitor and identify the most frequently executed processes on a system for a specific day. Here's a simple breakdown of what it does:

1. **Filter Data**: It starts by filtering out any records where the `ProcessName` or `StartDateTime` fields are missing, ensuring that only complete data is analyzed.

2. **Aggregate Data**: It then groups the data by `ProcessName` and the day (`StartDateTime` is binned into 1-day intervals). For each group, it counts how many times each process was executed.

3. **Sort Data**: The results are sorted in descending order based on the count, so the most frequently executed processes appear first.

4. **Select Output**: Finally, it selects and displays only the `ProcessName` and the corresponding count of executions.

In summary, this query helps you see which processes were run the most on a given day, sorted from most to least frequent.

Track the Usage of Specific Applications and How Often They Are Started.kql

This query is designed to analyze and audit system processes for security or operational efficiency. It retrieves a list of processes, including their names, IDs, working directories, start times, and command lines. The query filters out any processes that have a null or empty working directory. Finally, it sorts the results first by the process name and then by the start time, presenting the information in chronological order.

Track the Working Directories of Processes.kql

The query is searching for specific events in the Windows security event logs that indicate group membership additions. These events are checked for the past week. The purpose is to identify any unauthorized access or privilege escalation.

User Added to Privileged Group.kql

This query is designed to help identify and analyze security-related events in a Windows environment. Specifically, it focuses on detecting instances where a user's rights to perform privileged tasks have been enabled within the last 7 days. Here's a breakdown of the query:

1. **`WindowsEvent('Security', 7d)`**: This part of the query retrieves security events from the Windows event logs that have occurred in the past 7 days.

2. **`| where tostring(EventId) == '4704'`**: This filters the events to only include those with an Event ID of '4704'. In Windows security logs, Event ID 4704 indicates that a user right has been assigned, which often relates to enabling a user to perform privileged tasks.

In simple terms, this query looks at the security logs from the past week to find events where a user has been granted the ability to perform tasks that require higher privileges.

User Right Assigned.kql

This query is designed to help identify which applications and their specific versions are crashing most often in a Windows environment. It looks at data from `WindowsAppCrashEvent` and counts the number of crashes for each combination of application name (`AppName`) and application version (`AppVersion`). The result is a list showing how many times each app and version has crashed, which can be used to prioritize troubleshooting efforts and decide which software updates might be needed.

Windows App Crash Events Grouped by the App and Its Version.kql

This query is designed to fetch a list of Windows Quick Fix Engineering (QFE) updates that have been installed on a system. It organizes the results by the date each update was installed, showing the most recently installed updates first.

Windows Quick Fix Engineering Hot Fixes.kql

This query is designed to help with IT security auditing by identifying specific system-related events. It looks at events from the "System" log that occurred within the last 7 days. Specifically, it filters these events to find those with an Event ID of 19.

Device Query

Device Queries(72)