Browse by tag

120 tags across the KQL Library — MITRE ATT&CK, actors, platforms, data sources.

← All KQL categories

Every query in the library indexed by MITRE ATT&CK tactic and technique, by actor / malware family (where the write-up named one), by platform and data source, and by whether a KQL Detection of the Week Deep Dive article walks through its design. Pills are sorted by how many queries carry them.

Deep Dive 1

 Deep Dive42