Skip to content
Back to the Handbook
Free direct downloadMicrosoft 365Security

Detection Starter for Microsoft Sentinel

Three KQL detections plus the catalogue, tuning, hunting and review records needed to operate them.

Download the ZIPSee the files

No account and no email needed. An optional email copy is below.

How to use it

How to use this pack

Three KQL detections and the records to run them: this pack pairs the three KQL samples with the catalogue, tuning workflow, threat-hunt procedure and monthly review record needed to manage their lifecycle.

  1. Load the three KQL files as analytics rules in a test workspace.
  2. Record each rule in detection-catalog-template.md with an owner.
  3. Tune with runbooks/false-positive-tuning.md and review the set each month.

Before you rely on it

Validate schemas, thresholds, data coverage and response ownership before enabling alerts.

Want a copy in your inbox?

Optional email delivery makes the link easy to recover. You can download above without submitting anything.

Used only to fulfil this request. Read the privacy notice.

Published by Michal Jatczak, trading as ITSailor.SHA-256 for this pack