microsoft-defender-xdr

MDATP

M365 PowerShell scripts for Microsoft 365 administration: Intune, Entra ID, Defender, Exchange Online, Purview, Teams, SharePoint and tenant management. Microsoft Graph and modern modules only, read-only by default, -WhatIf on every change, full comment-based help.

Assess, convert and deploy Microsoft Sentinel analytics rules as Defender XDR custom detections

Microsoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.

Maps Microsoft Defender XDR Schemas to a local Kustainer Data Explorer instance

SOC Analyst Portfolio | Microsoft Defender XDR | Threat Hunting | Incident Response | Active Directory | Entra ID

Microsoft Defender XDR Advanced Hunting extension and investigation skills for pi

A collection of my KQL queries

Microsoft Security | Entra ID | Defender XDR | Security Operations

Generate production-like Microsoft Defender XDR telemetry based on a YAML profile

SOC-style cyber incident investigation using KQL, Microsoft Defender XDR, and threat intelligence to analyze phishing, malware execution, data exfiltration, and nation-state threat actors.

Rust MCP server for Microsoft Defender XDR and Defender for Endpoint: tools for hunting, threat intelligence, vulnerability management, and gated response.

Detection-as-Code threat-hunting framework for Microsoft Defender XDR & Sentinel

Cloud-native identity compromise hunt in Microsoft Entra ID and Microsoft 365. Reconstructed a patient operator's session from a Low-rated anonymous IP alert through internal spearphishing, inbox rule persistence, and credential theft using Sentinel KQL.

Curated, read-only library of KQL hunting queries for Microsoft Sentinel and Microsoft Defender XDR, organised by technology and mapped to MITRE ATT&CK. Maintained by Inside Technologies and shared freely with the security community. Powers the query catalogue in CyberGuard.

This repository contains demos and guides on how to setup Defender for Cloud. These demos are intended as a guide. For official guidance, support, or more detailed information, please refer to Microsoft's official documentation or contact Microsoft directly.

A curated list of high-quality resources focused on securing Microsoft cloud environments, including Identity (Entra ID), Microsoft 365, Microsoft Defender, Sentinel and Microsoft Purview.

Microsoft Defender XDR

Microsoft Defender XDR Action Types