The KQL Vault

Members only · Free

Unlock the KQL Vault

73 queries, 15 analytic rules ready to import, 3 workbooks, 3 Logic Apps and 4 scripts, all in one searchable page. Free with a subscription: enter your email, click the link we send, and the vault opens.

Email address

SubscribeSending

Nearly there. Check your inbox and click the link to confirm.

Already subscribed? Sign in

• Copy-ready KQL, with the tables each query needs listed above it
• Rule JSON you import straight into Microsoft Sentinel
• Search by name, table, MITRE ID or anything inside a query
• New queries added as new posts go out

// New identity-to-vault pairings in the last 24 hours
let lookback = 30d;
let detectWindow = 1d;
let OperationList = dynamic(["SecretGet","KeyGet","VaultGet","SecretList"]);
let Baseline = AzureDiagnostics
| where TimeGenerated between (ago(lookback) .. ago(detectWindow))
| where ResourceType =~ "VAULTS" and ResultType =~ "Success"
| where OperationName in (OperationList)