dvi23,github

enterprise-azure-policy-as-code

Enterprise-ready Azure Policy-as-Code (PaC) solution (includes Az DevOps pipeline)

enterprise-scale

The Azure Landing Zones (Enterprise-Scale) architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture

god-mode-rules

God Mode Detection Rules

hackergpt

hunting-queries-detection-rules

Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

intunedevicequery

This repository contains a wide array of KQL Queries ready for you to easily copy, paste, and execute within Intune.

ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

kql

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

kql-for-dfir

A guide to using Azure Data Explorer and KQL for DFIR

linux-hardening-checklist

Simple checklist to help you deploying the most important areas of the GNU/Linux production systems - work in progress.

mde-dfir-resources

A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

mde-quickstart

MDE Quickstart is a battle-tested MDE policy set designed to be restored with Intune Backup & Restore

microsoft-365-defender-hunting-queries

Sample queries for Advanced hunting in Microsoft 365 Defender

microsoftsentinel-azureopenai-ir-helper-playbook

microsoftsentinel-chatgpt-playbook

monkey365

Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews.

msidentitytools

Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities.