Bert-Jan

Hunting-Queries-Detection-Rules. KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Open-Source-Threat-Intel-Feeds. This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

Incident-Response-Powershell. PowerShell Digital Forensics & Incident Response Scripts.

KustoHawk. KustoHawk is a lightweight incident triage and response tool designed for effective incident response in Microsoft Defender XDR and Microsoft Sentinel environments.

Sentinel-Automation. Sentinel Logic Apps, Playbooks and Workbooks to automate enrichment, incident analysis and more.

SecScripts. Security Scripts and Sources for daily usage.

Domain-Response. Domain Response is a tool that is designed to help you automate the investigation for a domain. This tool is specificly designed to automated phishing domain investigations. However it can be used for every domain to gather all domain information needed. This can help to classify if a domain is malicious.

Sentinel-Queries. Collection of KQL queries

AzSentinelQueries. Repository with Sentinel Analytics Rules and Hunting Queries

Presentations.

awesome-kql-sentinel. A curated list of blogs, videos, tutorials, queries and anything else valuable to help you learn and master KQL and Microsoft Sentinel

awesome-detection-rules. This is a collection of threat detection rules / rules engines that I have come across.

Azure-Sentinel. Cloud-native SIEM for intelligent security analytics for your entire enterprise.

MDE-DFIR-Resources. A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

KustoCon2025. Workshop notes KustoCon 2025

Hunting-Queries-Detection-Rules-1. KQL Queries. Microsoft Defender, Microsoft Sentinel

ms-sentinel-scout. HTML

Sigma-AWS. This repository contains the research and components of our research into using Sigma for AWS Incident Response.

Invictus-training. Repository with supporting materials for Invictus Academy/Training

aws_dataset. A dataset with CloudTrail events from an attack simulation using Stratus.

ALFA. ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework

kql_queries. KQL queries for Incident Response