product

Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM and security operations platform for attack detection, threat visibility, proactive hunting, investigation, and response.

productsSentinelCurrent

Relationships

Related KQL

Detect file modification bursts by process

Summarize high-volume file create/modify activity by device, account, and initiating process as a ransomware-style triage signal.

detection candidate

advancedendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceFileEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let minimumEvents = {minimum_events};
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| summarize FileEvents=count(), Extensions=make_set(tolower(extract(@"\.([^.\\]+)$", 1, FolderPath)), 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileEvents >= minimumEvents
| order by FileEvents desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from ransomware TTP themes into a generic file-burst query for modeled MDE tables.

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template

advancedthreat-intelligenceendpoint

Run surface: Sentinel Logs
Required tables: ThreatIntelIndicators DeviceNetworkEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.

Pivot from suspicious email to URL clicks

Find delivered inbound messages from a suspicious sender domain, join URL metadata, then pivot into user click activity.

template

intermediatephishinguser-compromise

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents EmailUrlInfo UrlClickEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

let lookback = {lookback};
let senderDomain = "{sender_domain}";
let suspiciousMessages = EmailEvents
| where Timestamp > ago(lookback)
| where EmailDirection == "Inbound"
| where SenderFromDomain =~ senderDomain
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes;
suspiciousMessages
| join kind=leftouter (
    EmailUrlInfo
    | project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| join kind=leftouter (
    UrlClickEvents
    | where Timestamp > ago(lookback)
    | project ClickTimestamp=Timestamp, NetworkMessageId, AccountUpn, Url, ActionType, IsClickedThrough, ThreatTypes
) on NetworkMessageId, Url
| order by Timestamp desc, ClickTimestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing investigation themes with tenant-specific placeholders and current MDO table names.

Review Intune policy changes by operator

Summarize Intune audit activity by operation, identity, and result to spot policy edits, assignment changes, and deletions.

template

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneAuditLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneAuditLogs
| where TimeGenerated > ago({lookback})
| where OperationName has_any ("Create", "Update", "Delete", "Assign")
| summarize Events=count(), Failures=countif(ResultType !in ("Success", "Succeeded")), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by OperationName, Identity, ResultType
| order by LastSeen desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from Intune operational diagnostics themes for existing IntuneAuditLogs coverage.

Review suspicious PowerShell process launches

Find PowerShell process executions with common download, encoded-command, hidden-window, or bypass indicators.

detection candidate

intermediateendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceProcessEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let suspiciousTerms = dynamic(["-enc", "encodedcommand", "downloadstring", "invoke-webrequest", "iex", "-w hidden", "bypass"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousTerms)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountUpn, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from endpoint and ransomware hunting themes with common PowerShell indicators.

Summarize inbound email authentication failures

Parse EmailEvents authentication details to summarize SPF, DKIM, DMARC, and composite authentication outcomes by sender domain.

template

intermediatephishing

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

EmailEvents
| where Timestamp > ago({lookback})
| where EmailDirection == "Inbound"
| extend Auth = parse_json(AuthenticationDetails)
| extend SPF=tostring(Auth.SPF), DKIM=tostring(Auth.DKIM), DMARC=tostring(Auth.DMARC), CompAuth=tostring(Auth.CompAuth)
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 5) by SenderFromDomain, SPF, DKIM, DMARC, CompAuth, DeliveryAction
| order by Messages desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing and Microsoft 365 compromise themes; converted to a generalized authentication summary.

Track Sentinel incident volume and ownership

Summarize Sentinel incidents by severity, status, owner, and day for SOC handoff and workbook reporting.

workbook dashboard

beginnersentinel-operationsoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: SecurityIncident

kql

SecurityIncident
| where TimeGenerated > ago({lookback})
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by bin(TimeGenerated, 1d), Severity, Status, Owner
| order by TimeGenerated desc, Incidents desc

Source: KQLMSPress/definitive-guide-kql Chapter 2: Data Aggregation/Query Samples. Adapted from aggregation and operational dashboard patterns for Sentinel incident operations.

Trend Intune operational failures

Chart Intune operational failures by operation and category to troubleshoot device-management service issues.

workbook dashboard

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneOperationalLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneOperationalLogs
| where TimeGenerated > ago({lookback})
| summarize Events=count(), Failures=countif(Result !in ("Success", "Succeeded")) by bin(TimeGenerated, 1h), OperationName, Category
| where Failures > 0
| order by TimeGenerated desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from operational excellence and Intune diagnostic query themes.