Skip to content

EEN421/KQL-Queries

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

130 Commits
'Sort' function result comparison.kql
'Sort' function result comparison.kql
 
 
90 Day Billable Ingest Volume.kql
90 Day Billable Ingest Volume.kql
 
 
Average Daily Ingest Volume.kql
Average Daily Ingest Volume.kql
 
 
Cost of EventID by Computer.kql
Cost of EventID by Computer.kql
 
 
Cost of EventID.kql
Cost of EventID.kql
 
 
Cost of Syslog Events by Severity.kql
Cost of Syslog Events by Severity.kql
 
 
Cost of a Table.kql
Cost of a Table.kql
 
 
Cost_of_workstations_logging_direct_to_Sentinel.kql
Cost_of_workstations_logging_direct_to_Sentinel.kql
 
 
Day-by-Day-Change.kql
Day-by-Day-Change.kql
 
 
Efficiency Exercise.kql
Efficiency Exercise.kql
 
 
EventID by _BilledSize.kql
EventID by _BilledSize.kql
 
 
FailedLoginAttempts.kql
FailedLoginAttempts.kql
 
 
Failed_Login_Attempts_Analytics_Rule.kql
Failed_Login_Attempts_Analytics_Rule.kql
 
 
GB per Table.kql
GB per Table.kql
 
 
How Many Times Does This EventID fire from This Machine on This Day.kql
How Many Times Does This EventID fire from This Machine on This Day.kql
 
 
How loud is a Table?.kql
How loud is a Table?.kql
 
 
README.md
README.md
 
 
Top_10_Billable_Log_Sources.kql
Top_10_Billable_Log_Sources.kql
 
 
Top_10_Billable_MDE_Tables.kql
Top_10_Billable_MDE_Tables.kql
 
 
Top_10_EventIDs_Windows_SecurityEvents.kql
Top_10_EventIDs_Windows_SecurityEvents.kql
 
 
Top_10_Tables (exclude MDE).kql
Top_10_Tables (exclude MDE).kql
 
 
Top_10_WindowsEvent_EventIDs.kql
Top_10_WindowsEvent_EventIDs.kql
 
 
What's this user doing?.kql
What's this user doing?.kql
 
 
Which Accounts are Throwing this EventID?.kql
Which Accounts are Throwing this EventID?.kql
 
 
Which Devices are Throwing this EventID?.kql
Which Devices are Throwing this EventID?.kql
 
 
Which EventID fires the most in a month?.kql
Which EventID fires the most in a month?.kql
 
 

Repository files navigation

KQL-Queries

Hi, I'm Ian Hanley and here are my deceptively simple KQL queries I keep coming back to in order to solve complicated problems.

About

Ian Hanley's deceptively simple KQL queries.

hanley.cloud

Topics

azure cybersecurity devsecops cloud-security kql microsoft-sentinel

Resources

Readme
Activity

Stars

44 stars

Watchers

3 watching

Forks

8 forks
Report repository

Releases

No releases published

Packages

No packages published