Our take
Activeregular commits- Activity
- 53
- Community
- 94
- Issues
- 55
- Pull requests
- 56
+63 stars in the last 30 days
- More contributors than 78% of the projects we track
- Merges more pull requests than 78% of the projects we track
This is an actively maintained, broad community content library for Microsoft Sentinel and Microsoft 365 Defender, rather than a deployable security product.
Good fit if
- Your team uses Microsoft Sentinel or Microsoft 365 Defender and wants starting points for detections, hunting, workbooks or playbooks.
- You want to contribute security content: the project is active, has contributions from at least 100 contributors, and recent pull requests are merged quickly.
- You can review and adapt content for your own environment, including validating its KQL and detection configuration.
Look elsewhere if
- You need a standalone SIEM or a turnkey security service rather than content for Microsoft's platforms.
- You need a project with recent releases: the health data shows no releases in the past year, even though commits and pull requests remain active.
- Your environment does not use Microsoft Sentinel or Microsoft 365 Defender.
All health signals
| Last commit | 2026-10-14 (today) |
|---|---|
| Commits, last 90 days | 100+ |
| Releases, last 12 months | 0 |
| Contributors | 100+ (top contributor: 10% of commits) |
| Issues closed, last 90 days | 6+ (typically closed in 5 days) |
| Pull requests merged, last 90 days | 59 (typically merged in 1 day) |
| Project age | 8 years |
Checked on 2026-10-15 with the GitHub API.
Project history
Daily GitHub snapshots since Oct 7, 2026. History covers stars and forks; health signals are not tracked historically.
Stars
6,252Forks
3,895Change since Nov 13, 2026: +1 stars·+3 forks
Overview
Azure-Sentinel is a collection of security content for Microsoft Sentinel, Microsoft's cloud-native SIEM, and Microsoft 365 Defender. It helps security teams get started with security analytics and threat hunting by providing ready-to-adapt detections, queries, workbooks and playbooks.
The repository is for teams using those Microsoft security platforms, including analysts who want to explore data, hunt for threats or add detection and response content to their environments. It is a content repository rather than a standalone SIEM or a complete security service.
Key Features
- Detection templates for identifying security events.
- KQL exploration queries and threat-hunting queries.
- Microsoft 365 Defender advanced hunting queries for use in Defender and Sentinel.
- Workbooks for exploring and presenting security data.
- Playbooks for security response workflows.
- Pull request checks that validate detection structure, schema and KQL syntax.
- Contribution guidance for proposing and reviewing content.
Use Cases
- A Sentinel administrator can adapt detection templates when onboarding a new workspace or monitoring a particular threat.
- A security analyst can use hunting queries to investigate activity in Sentinel or Microsoft 365 Defender.
- A team can use workbooks to explore and present security data in its Sentinel environment.
- A contributor can submit or update community security content and use the repository's validation checks before review.
What you need
Detected in the repository
- Node.js (from package.json)
- Automated checks on GitHub Actions
License in plain words
MITpermissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the copyright and license notice
- Share your changes: no
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Browse the repository for content relevant to your Microsoft security environment. See the README and project wiki for contribution and validation details.
Considerations
- Content may need adaptation to the tables, schemas and configuration available in your workspace. The repository documents KQL and detection schema checks, including handling custom log tables.
- The project is active and not archived, but its health data records no releases in the past year. Treat repository changes as evolving community content, not as versioned product releases.
- Contributions require agreement to Microsoft's Contributor License Agreement. The repository is under the MIT license; review the project terms before reusing or submitting content.
Found this useful?
Share it with someone who would like Azure-Sentinel.