KQL Search

A specialized search engine for discovering Kusto Query Language (KQL) queries. Features query discovery across Microsoft Sentinel, Defender, and Azure Data Explorer, along with a Query Assistant, Query Generator, Query Lab for testing, and Device Query functionality. Aggregates community-contributed hunting queries and detection rules for threat hunting, vulnerability management, and incident response.

Created by

Ugur Koc

You might also like

Web App

PIM Portal

Quick and Consistent PIM activation with bulk option

J

Jan Ketil Skanke

Web App

PIMBuddy

PIMBuddy helps you get a better overview about your PIM. It even let's you deploy PIM Policies and Groups within Seconds.

Roman Padrun

PowerShell Module

MDEValidator

A PowerShell module for validating Microsoft Defender for Endpoint configurations. Checks service status, real-time protection, cloud protection, ASR rules, network protection, tamper protection, SmartScreen policies, and MDE onboarding status with HTML and console reporting.

Nathan Hutchinson

PS Script

Intune Make Enrollment User Admin

This Intune-deployable script elevates the enrollment user to a local administrator on Windows devices. Packaged as an .INTUNEWIN app, it is deployed through Microsoft Intune to targeted users with install and uninstall commands to grant or revoke admin rights after enrollment. It uses a requirements check for detection and can be reconfigured later, providing an Autopilot-like capability fully managed by Intune.

Niklas Rast