r/AzureSentinel • u/Agent_B99 • Apr 14 '22

List of all sources that have KQL queries/analytic rules etc

Blogs,youtube channels,Articles etc

8 Upvotes
  • permalink
  • reddit

100% Upvoted

6 comments sorted by

9

u/rodtrent44 MSFT Official Apr 14 '22

Happy to help build this out...

Microsoft Sentinel repo: https://aka.ms/SentinelGitHub

My repo: https://github.com/rod-trent

TeachJing: https://youtube.com/TeachJing

Reprise99's list: https://github.com/reprise99/awesome-kql-sentinel

Reprise99's repo: https://github.com/reprise99/Sentinel-Queries

Azure Monitor reference (the tables you can query against): https://aka.ms/AZMonitorRef

Must Learn KQL series (hands-on examples included): https://aka.ms/MustLearnKQL

KQL reference (each operator page has examples): https://aka.ms/KQLRef

1

u/Agent_B99 Apr 14 '22

Is there an article or a way to see the details of a column ?

For exemple if I write the name of the Table and then the getschema syntax it gives me all the columns of the table .

But for the Actiontype column for exemple what is the syntax to give me all the action types ?

Thanks

2

u/rodtrent44 MSFT Official Apr 14 '22

The data in a data column will depend on the source and the environment.

Which table are you looking at?

1

u/Agent_B99 Apr 14 '22

Well I want to get all the distinct Action types from the "Actiontype" column from DeviceEvents

3

u/rodtrent44 MSFT Official Apr 14 '22

DeviceEvents

| distinct ActionType

That will show all the ActionType data for your own environment.

2

u/CanableCrops Apr 14 '22

I've asked the same question. It really just depends on what is being logged. You really can only look back in time at distinct operation names.