We are announcing our new unified GitHub community for Microsoft SIEM and XDR, enabling SOC teams to centrally discover the latest hunting queries and analytics for Microsoft Sentinel and Microsoft Defender. Furthermore, community contributors can expand their impact to multiple products with a single contribution. This community brings together Microsoft Sentinel and Microsoft 365 Defender products as part of the Microsoft SIEM and XDR threat protection story.
About Microsoft SIEM and XDR
Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. Hunting queries can be built to provide value to Microsoft 365 Defender advanced hunting scenarios and can be used for custom detections as well.
Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Microsoft Sentinel provides a platform for different data sources to come together. Different types of contributions like hunting, detection and investigation queries, automated workflows, visualizations, and much more can be built to use one or many of these data sources. These contributions enable relevant security insights for automated hunting, alerting, incident tracking, investigations, and response experiences in Microsoft Sentinel.
Why unified community?
The unified Microsoft SIEM and XDR Community provides a forum for the community members, aka, Threat Hunters, to join in and submit these contributions via GitHub Pull Requests or contribution ideas as GitHub Issues. Hunting queries for Microsoft 365 Defender will provide value to both Microsoft 365 Defender and Microsoft Sentinel products, hence a multiple impact for a single contribution. These contributions can be just based on your idea of the value to enterprise your contribution provides or can be from the GitHub open issues list or even enhancements to existing contributions.
Get started now!
Participate in the unified GitHub community for Microsoft Sentinel and Microsoft 365 Defender.
- Contribute your queries to the Microsoft 365 Defender folder in the Hunting Queries section.
- Specifics on what is required for Hunting queries is in the Query Style Guide.
- Webcasts content can be found in the Tutorials folder.
- Power BI example can be found in the Tools folder.
