nicolonsky/ITDR

EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra ID.

Additional resources to improve customer experience with Microsoft Defender for Identity

Production-ready KQL queries for Microsoft Defender XDR and Microsoft Sentinel. Focused on Threat Hunting, Detection Engineering, and MITRE ATT&CK mapping.

Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.

Threat Hunting queries of multiple platforms

KQL Queries. Microsoft Defender, Microsoft Sentinel

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Hunting queries and detections