Azure/Azure-Sentinel

Microsoft Sentinel analytics rules: KQL queries run on a schedule against Log Analytics tables. Query against a store, on an interval.

YAML wrapping a KQL query, with the scheduling and alerting behavior declared alongside it:

name: SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)
severity: High
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics: [Execution, Persistence, InitialAccess]
relevantTechniques: [T1195, T1059, T1546]
query: |
  imFileEvent
  | where TargetFileMD5 in (SunburstMD5)
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User

queryFrequency and queryPeriod are separate on purpose — how often the rule runs versus how far back it looks — and triggerThreshold sets how many results constitute an alert.

entityMappings has no equivalent in most other sources: it tells Sentinel which result columns are accounts, hosts, IPs and files, which is what makes an alert pivotable and correlatable into incidents rather than a row of text.

Some rules query ASIM normalized schemas (imFileEvent, _Im_*) rather than raw tables, which makes them source-agnostic but requires the ASIM parsers to be deployed first.

tactics and relevantTechniques map directly to ATT&CK, so coverage here is reliable.

• This index does not hold all of Azure-Sentinel. Only Detections/ and Hunting Queries/ at the repository root are ingested. Microsoft has been migrating content into per-product Solutions/<name>/Analytic Rules/ folders, and none of that is walked — so absence from this site is not absence upstream. This is a known gap, tracked in the project's backlog.
• Rules querying ASIM schemas silently return nothing if the ASIM parsers are not deployed in the workspace. The rule looks fine and finds nothing.
• requiredDataConnectors is frequently empty even when the rule plainly needs a connector. Read the query's table names, not that field.