FalconForceTeam/FalconFriday

Threat Hunting queries of multiple platforms

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Production-ready KQL queries for Microsoft Defender XDR and Microsoft Sentinel. Focused on Threat Hunting, Detection Engineering, and MITRE ATT&CK mapping.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

KQL Queries. Microsoft Defender, Microsoft Sentinel

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

Threat hunting queries, Sigma rules, and detection engineering research based on MITRE ATT&CK techniques.

CQL Hub is an open repository of detection and hunting queries for CrowdStrike NextGen SIEM and Falcon LogScale. All queries stored here are automatically published to cql-hub.com , making them easily accessible to the community.

MCP to help Defenders Detection Engineer Harder and Smarter