SecOps SignalSecurity Intelligence Workspace
Collection UnavailablePublic Intel Only

KQL Library

Reference only · no query execution

Queries stored by SecOps Signal for Microsoft Defender and Sentinel hunting. Each shows its static-screening result and generation source; none has been run against a tenant.

Published queriesUnavailableDeterministic templatesUnavailableAdapted from SentinelUnavailable
CVEs coveredUnavailable
Runtime validatedUnavailable
Active criteria:None
Count unavailable
    KQL library records are temporarily unavailable.

    Clear filters, or try the community search tab for reference queries. An empty view does not mean no detection is possible.

    Record count unavailable
    Rows:102550

    Reading these queries

    • Schema Checked means the query passed SecOps Signal's structural screening against a reviewed table list. It is not a tenant test.
    • Not runtime validated means no one has recorded running it against live telemetry. Treat every query as a starting point and customise it.
    • Starter query appears where the stored record is marked as a starter or its reference lookup was deferred. Adapted queries credit the public Microsoft Sentinel reference they came from.
    KQL Library | SecOps Signal