micorsoft-sentinel

Here are 2 public repositories matching this topic...

goubx / sentinel-excessive-resource-activity-detection

Building a Microsoft Sentinel detection rule for excessive Azure resource creation and deletion using the AzureActivity log and KQL. Triaging caller activity and working the incident to closure under NIST SP 800-61.

mitre-attack kql azure-activity-logs kql-queries nist-800-61 micorsoft-sentinel

Updated Jun 19, 2026

wakuwaku528 / sentinel-detection-lab

Star

Hands-on Microsoft Sentinel SOC lab covering Azure telemetry ingestion, KQL detection engineering, alert tuning, incident triage, Active Directory and Entra ID identity attacks.

incident-response active-directory cybersecurity soc blue-team threat-detection kql detection-engineering microsoft-defender entra-id micorsoft-sentinel

Updated Sep 10, 2026
PowerShell

Add this topic to your repo

To associate your repository with the micorsoft-sentinel topic, visit your repo's landing page and select "manage topics."

Learn more