Azure-Sentinel repo (6.2k stars) packs detection rules, KQL queries and playbooks
davemccollough · x · 2026-11-11
A security practitioner highlights Microsoft's official Azure-Sentinel GitHub repo (6.2k stars, 3.9k forks, MIT licensed) as a solid resource for anyone working with Microsoft security.
The repo bundles:
- Detection rules and hunting queries
- KQL query samples, ASIM parsers, exploration queries
- Automation playbooks, data connectors, workbooks and dashboards
- Sample data, notebooks, tutorials and tools
It also ships AI coding tool configs (.claude/skills, .cursor/rules, .windsurf/rules), making it easy to reuse in modern workflows.
More from coding & agent
- Cursor ships multiplayer in Projects: shared task board with agent-to-agent requests — mattyp · 2026-11-11
- Why agents will soon have only one tool: Code Mode cuts spend 15%, +3.5 Terminal-Bench points — dl_weekly · 2026-11-11
- MCP Stock Assistant serves real-time A-share and US stock data via Xueqiu API — modelcontextprotocol · 2026-11-11
- Transita MCP matches ~45 visa pathways across 8 countries with official sources — modelcontextprotocol · 2026-11-11
- SAGE: Experience-Learning Agent Solves 84/88 NPU Kernel Synthesis Tasks on Ascend 910C — jiqizhixin · 2026-11-11
- Cursor Projects ushers in the 'third age' of coding agents, an orchestrator managing dozens — aryamankhawow · 2026-11-11