azure / Azure-Sentinel
File Size

The distribution of size of files (measured in lines of code).

Intro
Learn more...
File Size Overall
5% | 5% | 19% | 19% | 49%
Legend:
1001+
501-1000
201-500
101-200
1-100


explore: grouped by folders | grouped by size | sunburst | 3D view
File Size per Extension
1001+
501-1000
201-500
101-200
1-100
ps146% | 10% | 25% | 9% | 8%
yaml<1% | 1% | 16% | 19% | 61%
py1% | 16% | 28% | 23% | 29%
go0% | 53% | 0% | 33% | 12%
cs0% | 0% | 36% | 28% | 35%
csl0% | 0% | 58% | 0% | 41%
psm10% | 0% | 72% | 27% | 0%
js0% | 0% | 34% | 44% | 20%
rb0% | 0% | 11% | 57% | 30%
tf0% | 0% | 0% | 9% | 90%
psd10% | 0% | 0% | 0% | 100%
ts0% | 0% | 0% | 0% | 100%
xml0% | 0% | 0% | 0% | 100%
gemspec0% | 0% | 0% | 0% | 100%
html0% | 0% | 0% | 0% | 100%
liquid0% | 0% | 0% | 0% | 100%
spec0% | 0% | 0% | 0% | 100%
File Size per Logical Decomposition
primary
1001+
501-1000
201-500
101-200
1-100
Solutions4% | 5% | 13% | 16% | 58%
Tools46% | 17% | 16% | 11% | 7%
DataConnectors0% | 16% | 40% | 18% | 24%
Parsers0% | <1% | 50% | 39% | 9%
Watchlists0% | 89% | 0% | 0% | 10%
ASIM0% | 0% | 26% | 23% | 50%
Hunting Queries0% | 0% | 2% | 5% | 92%
Tutorials0% | 0% | 100% | 0% | 0%
Detections0% | 0% | 1% | 30% | 67%
Playbooks0% | 0% | 0% | 43% | 56%
Exploration Queries0% | 0% | 0% | 0% | 100%
Summary rules0% | 0% | 0% | 0% | 100%
Longest Files (Top 50)
File# lines# units
CollectExchSecIns.ps1
in Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Solutions/ESICollector/OnlineDeployment
 3543 -
CollectExchSecIns.ps1
in Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment
 3543 -
commonFunctions.ps1
in Tools/Create-Azure-Sentinel-Solution/common
 3350 -
createSolutionV2.ps1
in Tools/Create-Azure-Sentinel-Solution/V2
 2512 -
build_one_solution.ps1
in Solutions/CohesitySecurity
 1315 -
createSolution.ps1
in Tools/Create-Azure-Sentinel-Solution
 1314 -
CrowdStrikeReplicator_future.yaml
in Solutions/CrowdStrike Falcon Endpoint Protection/Parsers
 1123 -
1107 -
collector.py
in Solutions/Vectra XDR/Data Connectors/VectraDataConnector/SharedCode
 1099 27
CrowdStrikeReplicator.yaml
in Solutions/CrowdStrike Falcon Endpoint Protection/Parsers
 1074 -
corelight_corelight_metrics_disk.yaml
in Solutions/Corelight/Parsers
 968 -
utils.py
in Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/SharedCode
 948 17
createCCPConnector.ps1
in Tools/Create-Azure-Sentinel-Solution/common
 921 -
utils.py
in Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode
 751 13
sentinel.py
in Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/IndicatorCreatorToDefender
 751 13
JamfProtectTelemetry.yaml
in Solutions/Jamf Protect/Parsers
 740 -
utils.py
in Solutions/Mimecast/Data Connectors/MimecastTTP/SharedCode
 733 12
sentinel.py
in Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/NonCofenseBasedIndicatorCreatorToCofense
 727 12
sentinel.py
in Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SentinelToDefender
 711 12
netskope_to_azure_storage.py
in Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/NetskopeToAzureStorage
 699 3
Sentinel_AMA_troubleshoot.py
in DataConnectors/Syslog
 673 49
cef_troubleshoot.py
in DataConnectors/CEF
 653 43
SentinelOne.yaml
in Solutions/SentinelOne/Parsers
 651 -
utils.py
in Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode
 628 10
utils.py
in Solutions/Mimecast/Data Connectors/MimecastSEG/SharedCode
 625 10
Migrate-LA-to-ADX.ps1
in Tools/AzureDataExplorer
 613 -
Migrate-LA-to-ADX-Pipeline.ps1
in Tools/AzureDataExplorer/Pipeline
 611 -
main.go
in Solutions/BloodHound Enterprise/Data Connectors/pkg/connector
 597 18
vimNetworkSessionCiscoASA.yaml
in Parsers/ASimNetworkSession/Parsers
 590 -
OneLogin.yaml
in Solutions/OneLoginIAM/Parsers
 589 -
utils.py
in Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode
 565 9
mimecast_cg_to_sentinel.py
in Solutions/Mimecast/Data Connectors/MimecastSEG/MimecastCG
 555 2
cef_installer.py
in DataConnectors/CEF
 554 34
mimecast_ci_to_sentinel.py
in Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/MimecastCI
 553 2
__init__.py
in Solutions/VMware SD-WAN and SASE/Data Connectors/Function App Connector/vmw_sdwan_sase_funcapp/sdwan_efslogs
 547 9
__init__.py
in Solutions/CiscoUmbrella/Data Connectors/ciscoUmbrellaDataConn
 543 30
infoblox_to_azure_storage.py
in Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxHistoricalToAzureStorage
 538 10
run.ps1
in Watchlists/UpdateCloudIPs/AzureFunctionUpdateCloudIPs/UpdateCloudIPs
 529 -
message_factory.py
in Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib
 526 8
Playbook_ARM_Template_Generator.ps1
in Tools/Playbook-ARM-Template-Generator/src
 526 -
infoblox_to_azure_storage.py
in Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxCurrentToAzureStorage
 519 10
__init__.py
in DataConnectors/AWS-S3-AzureFunction/AzFun-AWS-S3-Ingestion
 512 28
Configure-Long-Term-Retention.ps1
in Tools/Archive-Log-Tool/ArchiveLogsTool-PowerShell
 510 -
vimAuthenticationPostgreSQL.yaml
in Parsers/ASimAuthentication/Parsers
 494 -
ASimFilteringTest.py
in ASIM/dev/ASimTester/filteringTest
 484 36
MSBizAppsOrgSettings.yaml
in Solutions/Microsoft Business Applications/Parsers
 478 -
mimecast_audit_to_sentinel.py
in Solutions/Mimecast/Data Connectors/MimecastAudit/MimecastAudit
 474 7
bitsight_statistics.py
in Solutions/BitSight/Data Connectors/BitSightDataConnector/AlertsGraphStatisticsDetails
 473 10
main.py
in Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ
 467 18
ASimNetworkSessionCiscoASA.yaml
in Parsers/ASimNetworkSession/Parsers
 461 -
Files With Most Units (Top 50)
File# lines# units
Sentinel_AMA_troubleshoot.py
in DataConnectors/Syslog
 673 49
cef_troubleshoot.py
in DataConnectors/CEF
 653 43
logstashLoganalyticsConfiguration.rb
in DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la
 193 38
ASimFilteringTest.py
in ASIM/dev/ASimTester/filteringTest
 484 36
cef_installer.py
in DataConnectors/CEF
 554 34
configurations.py
in Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code
 117 34
__init__.py
in Solutions/CiscoUmbrella/Data Connectors/ciscoUmbrellaDataConn
 543 30
logstashLoganalyticsConfiguration.rb
in DataConnectors/microsoft-logstash-output-azure-loganalytics/lib/logstash/logAnalyticsClient
 115 29
__init__.py
in DataConnectors/AWS-S3-AzureFunction/AzFun-AWS-S3-Ingestion
 512 28
collector.py
in Solutions/Vectra XDR/Data Connectors/VectraDataConnector/SharedCode
 1099 27
__init__.py
in DataConnectors/AWS-CloudTrail-AzureFunction/AzFunAWSCloudTrailLogsIngestion
 378 24
__init__.py
in Solutions/CognyteLuminar/Data Connectors/Cognyte Luminar
 403 20
Forwarder_AMA_installer.py
in DataConnectors/Syslog
 248 19
transform_utils.py
in Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code
 293 19
main.py
in Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ
 467 18
main.go
in Solutions/BloodHound Enterprise/Data Connectors/pkg/connector
 597 18
utils.py
in Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/SharedCode
 948 17
main.py
in Solutions/Sophos Endpoint Protection/Data Connectors/AzureFunctionSophos
 140 17
IncidentProducer.cs
in Solutions/CohesitySecurity/Data Connectors/Helios2Sentinel/IncidentProducer
 376 17
__init__.py
in DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion
 334 16
oat_service.py
in Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/services
 284 16
utils.py
in Solutions/ESET Protect Platform/Data Connectors/integration
 276 16
__init__.py
in Solutions/ZoomReports/Data Connectors/ZoomSentinelConnector
 299 16
__init__.py
in Solutions/GoogleWorkspaceReports/Data Connectors/GWorkspaceReportsAPISentinelConn/GWorkspaceReports-QueueTrigger
 273 16
exports_store.py
in Solutions/TenableIO/Data Connectors
 136 15
exports_store.py
in Solutions/Tenable App/Data Connectors/TenableVM
 138 15
models.py
in Solutions/ESET Protect Platform/Data Connectors/integration
 86 14
soar_connector_async.py
in Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator
 193 13
__init__.py
in Solutions/Lookout Cloud Security Platform for Microsoft Sentinel/Data Connectors/LookoutCSConnector/LookoutCloudSecurityEvents
 340 13
__init__.py
in Solutions/Lookout Cloud Security Platform for Microsoft Sentinel/Data Connectors/LookoutCSConnector/LookoutCloudSecurityViolations
 340 13
__init__.py
in Solutions/Lookout Cloud Security Platform for Microsoft Sentinel/Data Connectors/LookoutCSConnector/LookoutCloudSecurityAnamolies
 340 13
__init__.py
in Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector
 239 13
siem_parser.py
in Solutions/MimecastSEG/Data Connectors/TransformData
 146 13
main.py
in Solutions/CiscoDuoSecurity/Data Connectors/AzureFunctionCiscoDuo
 373 13
utils.py
in Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode
 751 13
sentinel.py
in Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/IndicatorCreatorToDefender
 751 13
main.py
in Solutions/Auth0/Data Connectors/Auth0Connector
 321 12
sentinel_connector.py
in Solutions/Oracle Cloud Infrastructure/Data Connectors/AzureFunctionOCILogs
 100 12
utils.py
in Solutions/IPinfo/Data Connectors/Privacy Extended/AzureFunctionIPinfoPrivacyExtended
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/Country ASN/AzureFunctionIPinfoCountryASN
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/WHOIS MNT/AzureFunctionIPinfoWHOISMNT
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/Iplocation/AzureFunctionIPinfoIplocation
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/ASN/AzureFunctionIPinfoASN
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/Carrier/AzureFunctionIPinfoCarrier
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/WHOIS POC/AzureFunctionIPinfoWHOISPOC
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/RWHOIS/AzureFunctionIPinfoRWHOIS
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/Privacy/AzureFunctionIPinfoPrivacy
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/Abuse/AzureFunctionIPinfoAbuse
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/Company/AzureFunctionIPinfoCompany
 153 12
utils.py
in Solutions/IPinfo/Data Connectors/WHOIS ASN/AzureFunctionIPinfoWHOISASN
 153 12
Files With Long Lines (Top 50)

There are 4039 files with lines longer than 120 characters. In total, there are 18242 long lines.

File# lines# units# long lines
commonFunctions.ps1
in Tools/Create-Azure-Sentinel-Solution/common
 3350 - 466
createSolutionV2.ps1
in Tools/Create-Azure-Sentinel-Solution/V2
 2512 - 373
CollectExchSecIns.ps1
in Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Solutions/ESICollector/OnlineDeployment
 3543 - 296
CollectExchSecIns.ps1
in Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment
 3543 - 296
MSBizAppsOrgSettings.yaml
in Solutions/Microsoft Business Applications/Parsers
 478 - 289
vimAuditEventCiscoISE.yaml
in Parsers/ASimAuditEvent/Parsers
 360 - 201
ASimAuditEventCiscoISE.yaml
in Parsers/ASimAuditEvent/Parsers
 295 - 201
1107 - 183
vimAuthenticationCiscoISE.yaml
in Parsers/ASimAuthentication/Parsers
 352 - 161
createSolution.ps1
in Tools/Create-Azure-Sentinel-Solution
 1314 - 159
ASimAuthenticationCiscoISE.yaml
in Parsers/ASimAuthentication/Parsers
 257 - 157
build_one_solution.ps1
in Solutions/CohesitySecurity
 1315 - 147
createCCPConnector.ps1
in Tools/Create-Azure-Sentinel-Solution/common
 921 - 137
Migrate-LA-to-ADX.ps1
in Tools/AzureDataExplorer
 613 - 78
Migrate-LA-to-ADX-Pipeline.ps1
in Tools/AzureDataExplorer/Pipeline
 611 - 76
vimNetworkSessionCiscoASA.yaml
in Parsers/ASimNetworkSession/Parsers
 590 - 68
ASimAuditEventIllumioSaaSCore.yaml
in Parsers/ASimAuditEvent/Parsers
 375 - 57
__init__.py
in Solutions/SlackAudit/Data Connectors/SlackAuditAPISentinelConnector
 278 7 57
createSolutionV4.ps1
in Tools/Create-Azure-Sentinel-Solution/pipeline
 305 - 57
__init__.py
in Solutions/VMware SD-WAN and SASE/Data Connectors/Function App Connector/vmw_sdwan_sase_funcapp/sdwan_efslogs
 547 9 55
Playbook_ARM_Template_Generator.ps1
in Tools/Playbook-ARM-Template-Generator/src
 526 - 55
vimNetworkSessionCiscoISE.yaml
in Parsers/ASimNetworkSession/Parsers
 226 - 54
ASimNetworkSessionCiscoASA.yaml
in Parsers/ASimNetworkSession/Parsers
 461 - 52
Cohesity_Playbook_ARM_Template_Generator.ps1
in Solutions/CohesitySecurity/Tools
 445 - 52
AwsResourceCreator.ps1
in DataConnectors/AWS-S3/Utils
 268 - 51
vimAuditEventIllumioSaaSCore.yaml
in Parsers/ASimAuditEvent/Parsers
 434 - 51
Create-LA-Tables-ADX-ScriptFile.ps1
in Tools/AzureDataExplorer/CreateTables_ADX_ScriptFile
 392 - 49
Configure-Long-Term-Retention.ps1
in Tools/Archive-Log-Tool/ArchiveLogsTool-PowerShell
 510 - 48
run.ps1
in DataConnectors/Qualys VM/AzureFunctionQualysVM
 212 - 45
get-ccp-details.ps1
in Tools/Create-Azure-Sentinel-Solution/common
 362 - 45
ASimNetworkSessionCiscoISE.yaml
in Parsers/ASimNetworkSession/Parsers
 159 - 44
ASimFilteringTest.py
in ASIM/dev/ASimTester/filteringTest
 484 36 39
run.ps1
in Solutions/QualysVM/Data Connectors/AzureFunctionQualysVM_V2
 285 - 39
createSolutionV3.ps1
in Tools/Create-Azure-Sentinel-Solution/V3
 292 - 39
cef_troubleshoot.py
in DataConnectors/CEF
 653 43 38
Create-LA-Tables-ADX.ps1
in Tools/AzureDataExplorer/CreateTables_ADX
 318 - 38
imNetworkSession.yaml
in Parsers/ASimNetworkSession/Parsers
 140 - 37
ASimNetworkSession.yaml
in Parsers/ASimNetworkSession/Parsers
 103 - 37
CiscoMeraki.yaml
in Solutions/CiscoMeraki/Parsers
 246 - 37
JamfProtectTelemetry.yaml
in Solutions/Jamf Protect/Parsers
 740 - 36
vimUserManagementCiscoISE.yaml
in Parsers/ASimUserManagement/Parsers
 173 - 35
run.ps1
in Solutions/Netskope/Data Connectors/Netskope/AzureFunctionNetskope
 388 - 34
run.ps1
in DataConnectors/M365Defender-VulnerabilityManagement/functionPackage/GetMDVMData
 243 - 33
ASimUserManagementCiscoISE.yaml
in Parsers/ASimUserManagement/Parsers
 130 - 33
imAuthentication.yaml
in Parsers/ASimAuthentication/Parsers
 115 - 33
run.ps1
in Solutions/Qualys VM Knowledgebase/Data Connectors/AzureFunctionQualysKB
 262 - 33
SyslogConnectorsOverallStatus.yaml
in Solutions/Syslog/Workspace Functions
 61 - 33
detect-anomalous-process-trees.yaml
in Hunting Queries/Microsoft 365 Defender/Execution
 93 - 32
vimNetworkSessionForcePointFirewall.yaml
in Parsers/ASimNetworkSession/Parsers
 416 - 32
SyslogConnectorsEventVolumebyDeviceProduct.yaml
in Solutions/Syslog/Workspace Functions
 56 - 32
Correlations

File Size vs. Commits (all time): 6180 points

Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CloudAppEvents_Updated.yaml x: 15 commits (all time) y: 72 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DeviceNetworkEvents_Updated.yaml x: 14 commits (all time) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_AzureActivity.yaml x: 20 commits (all time) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_OfficeActivity.yaml x: 20 commits (all time) y: 58 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 20 commits (all time) y: 75 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureFirewall.yaml x: 14 commits (all time) y: 69 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CloudAppEvents_Updated.yaml x: 14 commits (all time) y: 4 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CustomSecurityLog.yaml x: 16 commits (all time) y: 42 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_OfficeActivity.yaml x: 21 commits (all time) y: 64 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/imDns_DomainEntity_DnsEvents.yaml x: 21 commits (all time) y: 83 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 100 commits (all time) y: 78 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml x: 100 commits (all time) y: 39 lines of code DataConnectors/AWS-S3/Utils/CommonAwsPolicies.ps1 x: 155 commits (all time) y: 224 lines of code Solutions/AtlassianConfluenceAudit/Parsers/ConfluenceAudit.yaml x: 80 commits (all time) y: 76 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAgentPoolCreatedDeleted.yaml x: 158 commits (all time) y: 57 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAuditStreamDisabled.yaml x: 158 commits (all time) y: 37 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOMaliciousToolingDetections1.yaml x: 127 commits (all time) y: 36 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADONewExtensionAdded.yaml x: 134 commits (all time) y: 41 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml x: 202 commits (all time) y: 38 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml x: 207 commits (all time) y: 65 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOSecretNotSecured.yaml x: 134 commits (all time) y: 44 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml x: 187 commits (all time) y: 53 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOAdminGroupAdditions.yaml x: 157 commits (all time) y: 47 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOHistoricPrPolicyBypassing.yaml x: 190 commits (all time) y: 52 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOHistoricServiceConnectionAdds.yaml x: 180 commits (all time) y: 67 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOPatSessionMisuse.yaml x: 156 commits (all time) y: 50 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOPipelineCreatedDeletedOneDay.yaml x: 159 commits (all time) y: 69 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOServiceConnectionUsage.yaml x: 180 commits (all time) y: 38 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml x: 188 commits (all time) y: 72 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/NewPAPCAPCASaddedtoADO.yaml x: 179 commits (all time) y: 54 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml x: 151 commits (all time) y: 27 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildDeletedAfterPipelineMod.yaml x: 93 commits (all time) y: 19 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOInternalUpstreamPacakgeFeedAdded.yaml x: 151 commits (all time) y: 67 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewAgentPoolCreated.yaml x: 93 commits (all time) y: 6 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewPATOperation.yaml x: 94 commits (all time) y: 33 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewPackageFeedCreated.yaml x: 151 commits (all time) y: 34 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewReleaseApprover.yaml x: 93 commits (all time) y: 42 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOReleasePipelineCreated.yaml x: 95 commits (all time) y: 51 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/Addtional Org Admin Added.yaml x: 47 commits (all time) y: 30 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/AzDODisplayNameSwapping.yaml x: 47 commits (all time) y: 25 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/EntraID Conditional Access Disabled.yaml x: 70 commits (all time) y: 29 lines of code Solutions/AzureDevOpsAuditing/Parsers/ADOAuditLogs.yaml x: 12 commits (all time) y: 17 lines of code Solutions/ImpervaCloudWAF/Data Connectors/ImpervaWAFCloudSentinelConnector/__init__.py x: 187 commits (all time) y: 221 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit logging disabled.yaml x: 32 commits (all time) y: 68 lines of code Solutions/Microsoft Entra ID/Analytic Rules/DistribPassCrackAttempt.yaml x: 98 commits (all time) y: 60 lines of code Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml x: 179 commits (all time) y: 91 lines of code Solutions/QualysVM/Data Connectors/AzureFunctionQualysVM_V2/run.ps1 x: 54 commits (all time) y: 285 lines of code Solutions/QualysVM/Parsers/QualysHostDetection.yaml x: 74 commits (all time) y: 88 lines of code Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml x: 45 commits (all time) y: 65 lines of code Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxApplicationPrivilegeEscalationOrChange.yaml x: 52 commits (all time) y: 30 lines of code Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxMobileDeviceBootCompromise.yaml x: 50 commits (all time) y: 30 lines of code Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithCamera.yaml x: 54 commits (all time) y: 28 lines of code Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSecurityLogFull.yaml x: 56 commits (all time) y: 28 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_EvidenceOfMimikatzDCShadowAttack.yaml x: 131 commits (all time) y: 23 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_KerberoskrbtgtAccount.yaml x: 171 commits (all time) y: 32 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_RecentsIDHistoryChangesOnADObjects.yaml x: 172 commits (all time) y: 33 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_WellKnownPrivilegedSIDsInsIDHistory.yaml x: 131 commits (all time) y: 33 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Failed_Logons.yaml x: 160 commits (all time) y: 53 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Operations_Critical_Notifications_.yaml x: 162 commits (all time) y: 55 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_RBAC_Changes.yaml x: 161 commits (all time) y: 61 lines of code Solutions/Semperis Directory Services Protector/Parsers/dsp_parser.yaml x: 94 commits (all time) y: 44 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CommonSecurityLog.yaml x: 12 commits (all time) y: 50 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DnsEvents.yaml x: 18 commits (all time) y: 74 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_EmailUrlInfo_Updated.yaml x: 12 commits (all time) y: 66 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_PaloAlto.yaml x: 12 commits (all time) y: 108 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_imWebSession.yaml x: 18 commits (all time) y: 57 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/FileHashEntity_DeviceFileEvents_Updated.yaml x: 12 commits (all time) y: 38 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_imNetworkSession.yaml x: 14 commits (all time) y: 106 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/URLEntity_PaloAlto.yaml x: 12 commits (all time) y: 79 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_CustomSecurityLog.yaml x: 257 commits (all time) y: 69 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_imWebSession.yaml x: 294 commits (all time) y: 39 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/function_app.py x: 53 commits (all time) y: 80 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/message_factory.py x: 53 commits (all time) y: 526 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/withsecure_client.py x: 54 commits (all time) y: 146 lines of code Tools/Create-Azure-Sentinel-Solution/arm-ttk/run-arm-ttk-in-automation.ps1 x: 36 commits (all time) y: 45 lines of code Tools/Create-Azure-Sentinel-Solution/common/commonFunctions.ps1 x: 759 commits (all time) y: 3350 lines of code Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 x: 175 commits (all time) y: 921 lines of code DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 x: 161 commits (all time) y: 299 lines of code DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 x: 131 commits (all time) y: 97 lines of code DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 x: 175 commits (all time) y: 270 lines of code DataConnectors/AWS-S3/Utils/AwsPoliciesUpdate.ps1 x: 55 commits (all time) y: 125 lines of code DataConnectors/AWS-S3/Utils/AwsResourceCreator.ps1 x: 189 commits (all time) y: 268 lines of code DataConnectors/AWS-S3/Utils/AwsSentinelTag.ps1 x: 44 commits (all time) y: 15 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCDNLogsSetup/GCPCDNLogSetup.tf x: 13 commits (all time) y: 86 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPIAMCCPLogsSetup/GCPIAMLOGS.tf x: 17 commits (all time) y: 82 lines of code Detections/ASimProcess/SdeletedeployedviaGPOandrunrecursively(ASIMVersion).yaml x: 184 commits (all time) y: 35 lines of code Hunting Queries/Microsoft 365 Defender/Defense evasion/suspicious-base64-encoded-registry-keys.yaml x: 19 commits (all time) y: 26 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Email sender IP address Geo location information.yaml x: 15 commits (all time) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml x: 15 commits (all time) y: 30 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Email bombing.yaml x: 16 commits (all time) y: 12 lines of code Playbooks/Isolate-AzVM/Convert-SnapshotsToVHD.ps1 x: 11 commits (all time) y: 195 lines of code Playbooks/Isolate-AzVM/Set-ManagedIdentity.ps1 x: 11 commits (all time) y: 92 lines of code Solutions/AIShield AI Security Monitoring/Analytic Rules/BIIDetectionVulDetection.yaml x: 17 commits (all time) y: 41 lines of code Solutions/AIShield AI Security Monitoring/Parsers/Guardian.yaml x: 23 commits (all time) y: 27 lines of code Solutions/Armis/Data Connectors/ArmisDevice/ArmisDeviceSentinelConnector/__init__.py x: 150 commits (all time) y: 456 lines of code Solutions/AtlassianConfluenceAudit/Data Connectors/AtlassianConfluenceAuditDataConnector/ConfluenceAuditAPISentinelConnector/__init__.py x: 18 commits (all time) y: 115 lines of code Solutions/Azure Activity/Analytic Rules/Machine_Learning_Creation.yaml x: 27 commits (all time) y: 53 lines of code Solutions/Commvault Security IQ/Analytic Rules/CommvaultSecurityIQ_Alert.yaml x: 59 commits (all time) y: 35 lines of code Solutions/Commvault Security IQ/Analytic Rules/Data_Alert.yaml x: 81 commits (all time) y: 33 lines of code Solutions/Commvault Security IQ/Analytic Rules/User_Alert.yaml x: 84 commits (all time) y: 35 lines of code Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ/main.py x: 108 commits (all time) y: 467 lines of code Solutions/Commvault Security IQ/Playbooks/Runbooks/Commvault_Disable_Data_Aging.py x: 49 commits (all time) y: 78 lines of code Solutions/Commvault Security IQ/Playbooks/Runbooks/Commvault_Disable_IDP.py x: 49 commits (all time) y: 50 lines of code Solutions/Commvault Security IQ/Tools/AssignLogicAppRoles.ps1 x: 17 commits (all time) y: 67 lines of code Solutions/Commvault Security IQ/Tools/Setup-CommvaultAutomation.ps1 x: 17 commits (all time) y: 222 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_disk.yaml x: 10 commits (all time) y: 968 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_iface.yaml x: 10 commits (all time) y: 164 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_memory.yaml x: 10 commits (all time) y: 63 lines of code Solutions/Corelight/Parsers/corelight_files.yaml x: 90 commits (all time) y: 137 lines of code Solutions/Corelight/Parsers/corelight_http.yaml x: 91 commits (all time) y: 205 lines of code Solutions/Corelight/Parsers/corelight_intel.yaml x: 61 commits (all time) y: 101 lines of code Solutions/Corelight/Parsers/corelight_mysql.yaml x: 61 commits (all time) y: 87 lines of code Solutions/Corelight/Parsers/corelight_notice.yaml x: 61 commits (all time) y: 146 lines of code Solutions/Corelight/Parsers/corelight_smb_files.yaml x: 61 commits (all time) y: 125 lines of code Solutions/Corelight/Parsers/corelight_smtp.yaml x: 61 commits (all time) y: 129 lines of code Solutions/Corelight/Parsers/corelight_software.yaml x: 61 commits (all time) y: 74 lines of code Solutions/Corelight/Parsers/corelight_suri_aggregations.yaml x: 13 commits (all time) y: 64 lines of code Solutions/Corelight/Parsers/corelight_suricata_corelight.yaml x: 62 commits (all time) y: 207 lines of code Solutions/CyberArkAudit/Data Connectors/CyberArkAuditConnector/exporter.py x: 55 commits (all time) y: 45 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopDetectionsOrchestrator/__init__.py x: 11 commits (all time) y: 11 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopSentinelActivity/sentinel.py x: 11 commits (all time) y: 197 lines of code Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml x: 101 commits (all time) y: 35 lines of code Solutions/Google Apigee/Parsers/ApigeeXV2.yaml x: 18 commits (all time) y: 43 lines of code Solutions/GoogleCloudPlatformDNS/Parsers/GCPCloudDNS.yaml x: 92 commits (all time) y: 131 lines of code Solutions/IllumioSaaS/Data Connectors/CommonCode/constants.py x: 54 commits (all time) y: 45 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml x: 176 commits (all time) y: 81 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml x: 180 commits (all time) y: 4 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml x: 127 commits (all time) y: 52 lines of code Solutions/Jamf Protect/Parsers/JamfProtectAlerts.yaml x: 9 commits (all time) y: 20 lines of code Solutions/Jamf Protect/Parsers/JamfProtectNetworkTraffic.yaml x: 9 commits (all time) y: 61 lines of code Solutions/Jamf Protect/Parsers/JamfProtectTelemetry.yaml x: 9 commits (all time) y: 740 lines of code Solutions/Jamf Protect/Parsers/JamfProtectUnifiedLogs.yaml x: 9 commits (all time) y: 11 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/Hunting/Email bombing.yaml x: 17 commits (all time) y: 12 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SuspiciousServicePrincipalcreationactivity.yaml x: 106 commits (all time) y: 97 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/CollectExchSecIns.ps1 x: 19 commits (all time) y: 3543 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/ExchangeOnlinePermSetup.ps1 x: 16 commits (all time) y: 36 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Parsers/ExchangeAdminAuditLogs.yaml x: 149 commits (all time) y: 65 lines of code Solutions/Mimecast/Analytic Rules/MimecastAudit/Mimecast_Audit.yaml x: 46 commits (all time) y: 53 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_AV.yaml x: 65 commits (all time) y: 56 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Attachment.yaml x: 65 commits (all time) y: 54 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Spam_Event.yaml x: 66 commits (all time) y: 46 lines of code Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-PasswordSpray.yaml x: 86 commits (all time) y: 34 lines of code Solutions/SecurityBridge App/Analytical Rules/CriticalEventTriggered.yaml x: 174 commits (all time) y: 36 lines of code Solutions/SecurityBridge App/Parsers/SecurityBridgeLogs.yaml x: 87 commits (all time) y: 33 lines of code Solutions/Team Cymru Scout/Parsers/CymruScoutIP.yaml x: 42 commits (all time) y: 92 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/configurations.py x: 185 commits (all time) y: 117 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/timer_trigger/__init__.py x: 151 commits (all time) y: 104 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/timer_trigger_oat/__init__.py x: 193 commits (all time) y: 105 lines of code Summary rules/DNS/ZscalarDNSEventsIPSummary.yaml x: 16 commits (all time) y: 27 lines of code DataConnectors/Syslog/Forwarder_AMA_installer.py x: 252 commits (all time) y: 248 lines of code Solutions/Azure Web Application Firewall (WAF)/Analytic Rules/App-GW-WAF-SQLiDetection.yaml x: 56 commits (all time) y: 56 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/main.py x: 71 commits (all time) y: 147 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/models.py x: 67 commits (all time) y: 86 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/utils.py x: 81 commits (all time) y: 276 lines of code Solutions/IPinfo/Data Connectors/ASN/AzureFunctionIPinfoASN/utils.py x: 15 commits (all time) y: 153 lines of code Solutions/IPinfo/Data Connectors/Iplocation Extended/AzureFunctionIPinfoIplocationExtended/main.py x: 15 commits (all time) y: 84 lines of code Solutions/Microsoft 365/Analytic Rules/MailItemsAccessedTimeSeries.yaml x: 193 commits (all time) y: 80 lines of code Solutions/Microsoft Entra ID/Analytic Rules/NRT_AuthenticationMethodsChangedforVIPUsers.yaml x: 107 commits (all time) y: 66 lines of code Solutions/ProofPointTap/Analytic Rules/MalwareLinkClicked.yaml x: 239 commits (all time) y: 52 lines of code Solutions/Proofpoint On demand(POD) Email Security/Data Connectors/ProofpointSentinelConnector/__init__.py x: 129 commits (all time) y: 165 lines of code Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml x: 107 commits (all time) y: 52 lines of code DataConnectors/M365Defender-VulnerabilityManagement/maintenance/deployLatestFunctionPackage.ps1 x: 77 commits (all time) y: 7 lines of code Detections/MultipleDataSources/AnomalousIPUsageFollowedByTeamsAction.yaml x: 311 commits (all time) y: 128 lines of code Hunting Queries/AzureStorage/AzureStorageFileCreatedQuicklyDeleted.yaml x: 65 commits (all time) y: 39 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Attachment/ATP policy status check.yaml x: 88 commits (all time) y: 27 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Attachment/JNLP attachment.yaml x: 87 commits (all time) y: 18 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Hunt for TABL changes.yaml x: 86 commits (all time) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/MDO daily detection summary report.yaml x: 87 commits (all time) y: 65 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Malicious email senders.yaml x: 90 commits (all time) y: 22 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/New TABL Items.yaml x: 92 commits (all time) y: 33 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Emails containing links to IP addresses.yaml x: 48 commits (all time) y: 18 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Good emails from senders with bad patterns.yaml x: 48 commits (all time) y: 30 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Mailflow/Detections by detection methods.yaml x: 89 commits (all time) y: 46 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Mailflow/Mail reply to new domain.yaml x: 89 commits (all time) y: 40 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/Email containing malware accessed on a unmanaged device.yaml x: 95 commits (all time) y: 30 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/Email containing malware sent by an internal sender.yaml x: 95 commits (all time) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/Malware detections by detection methods.yaml x: 90 commits (all time) y: 32 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Emails delivered having URLs from QR codes.yaml x: 91 commits (all time) y: 25 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Emails with QR codes from non-prevalent sender.yaml x: 91 commits (all time) y: 36 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Hunting for sender patterns.yaml x: 87 commits (all time) y: 47 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/URL Click/URL click on ZAP Email.yaml x: 98 commits (all time) y: 23 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/URL Click/URL clicks actions by URL.yaml x: 97 commits (all time) y: 22 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Phishing Email Url Redirector.yaml x: 88 commits (all time) y: 6 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEvent.yaml x: 413 commits (all time) y: 63 lines of code Parsers/ASimAuditEvent/Parsers/imAuditEvent.yaml x: 400 commits (all time) y: 93 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventNative.yaml x: 36 commits (all time) y: 103 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml x: 512 commits (all time) y: 86 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationNative.yaml x: 29 commits (all time) y: 43 lines of code Parsers/ASimAuthentication/Parsers/imAuthentication.yaml x: 500 commits (all time) y: 115 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationNative.yaml x: 39 commits (all time) y: 105 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoASA.yaml x: 98 commits (all time) y: 461 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoASA.yaml x: 66 commits (all time) y: 590 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async.py x: 226 commits (all time) y: 193 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async_v2.py x: 77 commits (all time) y: 230 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/utils.py x: 60 commits (all time) y: 135 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_LogTampering.yaml x: 180 commits (all time) y: 49 lines of code Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/UserAgentSearch_log4j.yaml x: 220 commits (all time) y: 101 lines of code Solutions/AristaAwakeSecurity/Analytic Rules/HighMatchCountsByDevice.yaml x: 147 commits (all time) y: 63 lines of code Solutions/Azure Cloud NGFW by Palo Alto Networks/Analytic Rules/CloudNGFW-PortScanning.yaml x: 122 commits (all time) y: 60 lines of code Solutions/Azure Cloud NGFW by Palo Alto Networks/Analytic Rules/CloudNGFW-UnusualThreatSignatures.yaml x: 82 commits (all time) y: 59 lines of code Solutions/Azure Cloud NGFW by Palo Alto Networks/Hunting Queries/CloudNGFW-HighRiskPorts.yaml x: 65 commits (all time) y: 114 lines of code Solutions/BloodHound Enterprise/Analytic Rules/BloodHoundEnterpriseCriticalAttackPaths.yaml x: 146 commits (all time) y: 30 lines of code Solutions/BloodHound Enterprise/Data Connectors/handler.go x: 33 commits (all time) y: 172 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/bloodhound/client.go x: 35 commits (all time) y: 200 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/connector/main.go x: 49 commits (all time) y: 597 lines of code Solutions/CTERA/Analytic Rules/RansomwareDetected.yaml x: 44 commits (all time) y: 48 lines of code Solutions/CTERA/Hunting Queries/AccessDenied.yaml x: 20 commits (all time) y: 40 lines of code Solutions/CTERA/Hunting Queries/BatchDeletions.yaml x: 18 commits (all time) y: 40 lines of code Solutions/CiscoWSA/Analytic Rules/CiscoWSAAccessToUnwantedSite.yaml x: 128 commits (all time) y: 31 lines of code Solutions/CiscoWSA/Analytic Rules/CiscoWSAMultipleErrorsToUnwantedCategory.yaml x: 115 commits (all time) y: 40 lines of code Solutions/CiscoWSA/Analytic Rules/CiscoWSAMultipleInfectedFiles.yaml x: 110 commits (all time) y: 36 lines of code Solutions/CiscoWSA/Analytic Rules/CiscoWSAUnscannableFile.yaml x: 116 commits (all time) y: 38 lines of code Solutions/CiscoWSA/Hunting Queries/CiscoWSABlockedFiles.yaml x: 68 commits (all time) y: 24 lines of code Solutions/CiscoWSA/Hunting Queries/CiscoWSAUncategorizedResources.yaml x: 68 commits (all time) y: 32 lines of code Solutions/CiscoWSA/Hunting Queries/CiscoWSAUploadedFiles.yaml x: 69 commits (all time) y: 25 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicator/CrowdstrikeFalconAPISentinelConnector/__init__.py x: 153 commits (all time) y: 195 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/QueueTriggerCS/__init__.py x: 165 commits (all time) y: 284 lines of code Solutions/CyberArkAudit/Data Connectors/CyberArkAuditConnector/audit.py x: 44 commits (all time) y: 165 lines of code Solutions/CyberArkEPM/DataConnectors/CyberArkEPMSentinelConnector/__init__.py x: 73 commits (all time) y: 160 lines of code Solutions/Dragos/Analytic Rules/DragosNotifiction.yaml x: 33 commits (all time) y: 63 lines of code Solutions/Dragos/Parsers/DragosNotificationsToSentinel.yaml x: 28 commits (all time) y: 18 lines of code Solutions/Dragos/Parsers/DragosPullNotificationsToSentinel.yaml x: 28 commits (all time) y: 46 lines of code Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml x: 105 commits (all time) y: 31 lines of code Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Hunting Queries/Unexpected Countries.yaml x: 105 commits (all time) y: 27 lines of code Solutions/GitLab/Analytic Rules/GitLab_BruteForce.yaml x: 100 commits (all time) y: 48 lines of code Solutions/GitLab/Analytic Rules/GitLab_Impersonation.yaml x: 132 commits (all time) y: 48 lines of code Solutions/GitLab/Analytic Rules/GitLab_PAT_Repo.yaml x: 97 commits (all time) y: 36 lines of code Solutions/GitLab/Analytic Rules/GitLab_Repo_Deletion.yaml x: 96 commits (all time) y: 52 lines of code Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Deny Rate.yaml x: 83 commits (all time) y: 58 lines of code Solutions/Global Secure Access/Analytic Rules/SWG - Abnormal Port to Protocol.yaml x: 84 commits (all time) y: 54 lines of code Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml x: 45 commits (all time) y: 41 lines of code Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml x: 53 commits (all time) y: 58 lines of code Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml x: 43 commits (all time) y: 47 lines of code Solutions/IllumioSaaS/Data Connectors/TimedApiFunctionApp/api_response.py x: 88 commits (all time) y: 179 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml x: 171 commits (all time) y: 66 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml x: 279 commits (all time) y: 67 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml x: 171 commits (all time) y: 51 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-CommonSecurityLogMatchFound-MalwareC2.yaml x: 173 commits (all time) y: 67 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml x: 190 commits (all time) y: 79 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-SyslogMatchFound-URL.yaml x: 174 commits (all time) y: 69 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTDenialofService.yaml x: 271 commits (all time) y: 76 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTExcessiveLoginAttempts.yaml x: 261 commits (all time) y: 76 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTHighBandwidth.yaml x: 274 commits (all time) y: 76 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTINoSensorTrafficDetected.yaml x: 210 commits (all time) y: 76 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTInsecurePLC.yaml x: 260 commits (all time) y: 76 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTUnauthorizedRemoteAccess.yaml x: 257 commits (all time) y: 76 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Persistence/LocalAdminGroupChanges.yaml x: 87 commits (all time) y: 83 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/PossibleWebpBufferOverflow.yaml x: 137 commits (all time) y: 87 lines of code Solutions/Microsoft Entra ID/Analytic Rules/MFARejectedbyUser.yaml x: 155 commits (all time) y: 85 lines of code Solutions/Nasuni/Analytic Rules/RansomwareAttackDetected.yaml x: 129 commits (all time) y: 50 lines of code Solutions/Nasuni/Hunting Queries/FileDeleteEvents.yaml x: 126 commits (all time) y: 71 lines of code Solutions/NetClean ProActive/Analytic Rules/NetClean_Sentinel_analytic_rule.yaml x: 86 commits (all time) y: 45 lines of code Solutions/Okta Single Sign-On/Analytic Rules/LoginfromUsersfromDifferentCountrieswithin3hours.yaml x: 163 commits (all time) y: 37 lines of code Solutions/Okta Single Sign-On/Analytic Rules/PasswordSpray.yaml x: 165 commits (all time) y: 40 lines of code Solutions/Oracle Cloud Infrastructure/Data Connectors/AzureFunctionOCILogs/main.py x: 451 commits (all time) y: 163 lines of code Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml x: 149 commits (all time) y: 43 lines of code Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml x: 149 commits (all time) y: 36 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditActionsByIp.yaml x: 76 commits (all time) y: 35 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditActiveUsers.yaml x: 76 commits (all time) y: 25 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditDbConnectNonOperationalTime.yaml x: 120 commits (all time) y: 39 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditListOfTablesQueried.yaml x: 98 commits (all time) y: 29 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditUsersNewPrivilegesAdded.yaml x: 137 commits (all time) y: 33 lines of code Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicMultipleClientErrorsFromSingleIP.yaml x: 118 commits (all time) y: 33 lines of code Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicPutSuspiciousFiles.yaml x: 115 commits (all time) y: 43 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogic403RequestsFiles.yaml x: 115 commits (all time) y: 25 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicAbnormalRequestSize.yaml x: 53 commits (all time) y: 32 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicErrors.yaml x: 82 commits (all time) y: 22 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicRareURLsRequested.yaml x: 53 commits (all time) y: 25 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicUncommonUserAgents.yaml x: 54 commits (all time) y: 26 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-NetworkBeaconing.yaml x: 246 commits (all time) y: 65 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-PortScanning.yaml x: 285 commits (all time) y: 65 lines of code Solutions/Recorded Future/Analytic Rules/RecordedFutureDomainMalwareC2inSyslogEvents.yaml x: 216 commits (all time) y: 49 lines of code Solutions/SAP BTP/Analytic Rules/BTP - Failed access attempts across multiple BAS subaccounts.yaml x: 17 commits (all time) y: 47 lines of code Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector/__init__.py x: 148 commits (all time) y: 239 lines of code Solutions/SentinelOne/Parsers/SentinelOne.yaml x: 102 commits (all time) y: 651 lines of code Solutions/Symantec Endpoint Protection/Analytic Rules/ExcessiveBlockedTrafficGeneratedbyUser.yaml x: 207 commits (all time) y: 54 lines of code Solutions/Symantec Endpoint Protection/Analytic Rules/MalwareDetected.yaml x: 218 commits (all time) y: 39 lines of code Solutions/Threat Intelligence/Analytic Rules/Threat Intel Matches to GitHub Audit Logs.yaml x: 181 commits (all time) y: 28 lines of code Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 x: 467 commits (all time) y: 292 lines of code Tools/Create-Azure-Sentinel-Solution/common/get-ccp-details.ps1 x: 68 commits (all time) y: 362 lines of code ASIM/dev/ASimYaml2ARM/KqlFuncYaml2Arm.py x: 136 commits (all time) y: 219 lines of code ASIM/dev/Parser YAML templates/ASimAlertEventTemplate.yaml x: 36 commits (all time) y: 30 lines of code ASIM/dev/Parser YAML templates/ASimAuthenticationTemplate.yaml x: 117 commits (all time) y: 30 lines of code ASIM/dev/Parser YAML templates/ASimDhcpEventTemplate.yaml x: 67 commits (all time) y: 30 lines of code ASIM/dev/Parser YAML templates/ASimFileEventTemplate.yaml x: 141 commits (all time) y: 30 lines of code ASIM/dev/Parser YAML templates/vimAlertEventTemplate.yaml x: 36 commits (all time) y: 82 lines of code ASIM/dev/Parser YAML templates/vimAuditEventTemplate.yaml x: 98 commits (all time) y: 77 lines of code ASIM/dev/Parser YAML templates/vimAuthenticationTemplate.yaml x: 120 commits (all time) y: 95 lines of code ASIM/dev/Parser YAML templates/vimDhcpEventTemplate.yaml x: 67 commits (all time) y: 62 lines of code ASIM/dev/Parser YAML templates/vimDnsTemplate.yaml x: 119 commits (all time) y: 72 lines of code ASIM/dev/Parser YAML templates/vimNetworkSessionTemplate.yaml x: 121 commits (all time) y: 77 lines of code ASIM/dev/Parser YAML templates/vimProcessEventTemplate.yaml x: 100 commits (all time) y: 97 lines of code ASIM/dev/Parser YAML templates/vimUserManagementTemplate.yaml x: 97 commits (all time) y: 62 lines of code DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion/__init__.py x: 222 commits (all time) y: 334 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPFirewallLogsSetup/GCPFirewallLogSetup.tf x: 31 commits (all time) y: 82 lines of code DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 x: 190 commits (all time) y: 276 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashEventsBatcher.rb x: 82 commits (all time) y: 115 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/version.rb x: 182 commits (all time) y: 9 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec x: 80 commits (all time) y: 19 lines of code Detections/CommonSecurityLog/MultiVendor-PossibleDGAContacts.yaml x: 244 commits (all time) y: 132 lines of code Detections/MultipleDataSources/AADHostLoginCorrelation.yaml x: 372 commits (all time) y: 128 lines of code Detections/MultipleDataSources/MailBoxTampering.yaml x: 127 commits (all time) y: 89 lines of code Detections/MultipleDataSources/powershell_MangoSandstorm.yaml x: 105 commits (all time) y: 79 lines of code Detections/SecurityAlert/AVSpringShell.yaml x: 215 commits (all time) y: 5 lines of code Exploration Queries/InputEntity_Account/UserAccount_ScreenshotHosts.yaml x: 71 commits (all time) y: 25 lines of code Hunting Queries/BehaviorAnalytics/Anomalous AAD Account Manipulation.yaml x: 200 commits (all time) y: 4 lines of code Hunting Queries/DeviceProcess/VScodeExtensionofanUser.yaml x: 25 commits (all time) y: 45 lines of code Hunting Queries/Microsoft 365 Defender/Persistence/rare_sch_task_with_activity.yaml x: 28 commits (all time) y: 28 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventMicrosoftDefenderXDR.yaml x: 36 commits (all time) y: 174 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventSentinelOneSingularity.yaml x: 36 commits (all time) y: 113 lines of code Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml x: 38 commits (all time) y: 78 lines of code Parsers/ASimAlertEvent/Parsers/vimAlertEventEmpty.yaml x: 38 commits (all time) y: 129 lines of code Parsers/ASimAlertEvent/Parsers/vimAlertEventMicrosoftDefenderXDR.yaml x: 36 commits (all time) y: 228 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventIllumioSaaSCore.yaml x: 43 commits (all time) y: 375 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventInfobloxBloxOne.yaml x: 33 commits (all time) y: 143 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventIllumioSaaSCore.yaml x: 38 commits (all time) y: 434 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationIllumioSaaSCore.yaml x: 30 commits (all time) y: 87 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationMicrosoftWindowsEvent.yaml x: 260 commits (all time) y: 214 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml x: 252 commits (all time) y: 396 lines of code Parsers/ASimDhcpEvent/Parsers/ASimDhcpEvent.yaml x: 61 commits (all time) y: 36 lines of code Parsers/ASimDhcpEvent/Parsers/ASimDhcpEventInfobloxBloxOne.yaml x: 31 commits (all time) y: 135 lines of code Parsers/ASimDhcpEvent/Parsers/imDhcpEvent.yaml x: 60 commits (all time) y: 65 lines of code Parsers/ASimDhcpEvent/Parsers/vimDhcpEventInfobloxBloxOne.yaml x: 31 commits (all time) y: 175 lines of code Parsers/ASimDns/Parsers/ASimDns.yaml x: 230 commits (all time) y: 59 lines of code Parsers/ASimDns/Parsers/ASimDnsInfobloxBloxOne.yaml x: 33 commits (all time) y: 229 lines of code Parsers/ASimDns/Parsers/imDns.yaml x: 217 commits (all time) y: 86 lines of code Parsers/ASimDns/Parsers/vimDnsInfobloxBloxOne.yaml x: 34 commits (all time) y: 285 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml x: 703 commits (all time) y: 103 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionIllumioSaaSCore.yaml x: 40 commits (all time) y: 306 lines of code Parsers/ASimNetworkSession/Parsers/imNetworkSession.yaml x: 689 commits (all time) y: 140 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionIllumioSaaSCore.yaml x: 39 commits (all time) y: 385 lines of code Playbooks/AS-Microsoft-DCR-Log-Ingestion/Scripts/OfficeAuditSubscriptionEnable.ps1 x: 24 commits (all time) y: 26 lines of code Playbooks/MDTI-Actor-Lookup/function_app.py x: 42 commits (all time) y: 104 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/__init__.py x: 158 commits (all time) y: 143 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async_v2_local_run.py x: 30 commits (all time) y: 75 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_OverlyPermessiveKMS.yaml x: 158 commits (all time) y: 47 lines of code Solutions/ApacheHTTPServer/Analytic Rules/ApachePutSuspiciousFiles.yaml x: 102 commits (all time) y: 39 lines of code Solutions/ApacheHTTPServer/Analytic Rules/ApacheRequestToRareFile.yaml x: 102 commits (all time) y: 42 lines of code Solutions/ApacheHTTPServer/Hunting Queries/ApacheFilesRequested.yaml x: 60 commits (all time) y: 27 lines of code Solutions/ApacheHTTPServer/Hunting Queries/ApacheRareUAWithClientErrors.yaml x: 101 commits (all time) y: 26 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/__init__.py x: 55 commits (all time) y: 340 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/exports_store.py x: 32 commits (all time) y: 74 lines of code Solutions/Armis/Data Connectors/ArmisDevice/ArmisDeviceSentinelConnector/state_manager.py x: 63 commits (all time) y: 32 lines of code Solutions/Armis/Data Connectors/ArmisDevice/Exceptions/ArmisExceptions.py x: 63 commits (all time) y: 6 lines of code Solutions/Azure Cloud NGFW by Palo Alto Networks/Analytic Rules/CloudNGFW-NetworkBeaconing.yaml x: 90 commits (all time) y: 67 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/AlertsGraphStatisticsDetails/bitsight_statistics.py x: 81 commits (all time) y: 473 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/BreachesDetails/bitsight_breaches.py x: 116 commits (all time) y: 189 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/CompaniesDetails/bitsight_companies.py x: 115 commits (all time) y: 248 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/FindingsSummaryDetails/bitsight_findings_summary.py x: 116 commits (all time) y: 226 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/PortFolioCompanies/bitsight_portfolio.py x: 64 commits (all time) y: 134 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/SharedCode/bitsight_client.py x: 86 commits (all time) y: 153 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/SharedCode/utils.py x: 66 commits (all time) y: 201 lines of code Solutions/Box/Parsers/BoxEvents.yaml x: 86 commits (all time) y: 320 lines of code Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml x: 176 commits (all time) y: 38 lines of code Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml x: 176 commits (all time) y: 42 lines of code Solutions/Cisco ISE/Analytic Rules/CiscoISECmdExecutionWithHighestPrivilegesNewIP.yaml x: 238 commits (all time) y: 51 lines of code Solutions/Cisco ISE/Hunting Queries/CiscoISEAuthenticationToSuspendedAccount.yaml x: 75 commits (all time) y: 16 lines of code Solutions/Cisco ISE/Hunting Queries/CiscoISEExpiredCertInClientCertChain.yaml x: 75 commits (all time) y: 13 lines of code Solutions/CiscoSEG/Analytic Rules/CiscoSEGMultipleSuspiciousEmails.yaml x: 185 commits (all time) y: 34 lines of code Solutions/CiscoSEG/Analytic Rules/CiscoSEGPotentialLinkToMalwareDownload.yaml x: 183 commits (all time) y: 33 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGDroppedInMails.yaml x: 137 commits (all time) y: 25 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGDroppedOutMails.yaml x: 133 commits (all time) y: 25 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGFailedDKIMFailure.yaml x: 132 commits (all time) y: 25 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGInsecureProtocol.yaml x: 160 commits (all time) y: 25 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGSpamMails.yaml x: 173 commits (all time) y: 27 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGUsersReceivedSpam.yaml x: 221 commits (all time) y: 27 lines of code Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml x: 198 commits (all time) y: 30 lines of code Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml x: 229 commits (all time) y: 44 lines of code Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml x: 199 commits (all time) y: 35 lines of code Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml x: 229 commits (all time) y: 37 lines of code Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml x: 147 commits (all time) y: 24 lines of code Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml x: 148 commits (all time) y: 24 lines of code Solutions/Cloudflare/Data Connectors/AzureFunctionCloudflare/main.py x: 381 commits (all time) y: 160 lines of code Solutions/Cloudflare/Data Connectors/AzureFunctionCloudflare/sentinel_connector_async.py x: 101 commits (all time) y: 94 lines of code Solutions/CohesitySecurity/Data Connectors/Helios2Sentinel/IncidentProducer/IncidentProducer.cs x: 138 commits (all time) y: 376 lines of code Solutions/Corelight/Parsers/corelight_conn.yaml x: 80 commits (all time) y: 198 lines of code Solutions/Corelight/Parsers/corelight_dns.yaml x: 80 commits (all time) y: 167 lines of code Solutions/Corelight/Parsers/corelight_etc_viz.yaml x: 80 commits (all time) y: 111 lines of code Solutions/Corelight/Parsers/corelight_rdp.yaml x: 80 commits (all time) y: 117 lines of code Solutions/Corelight/Parsers/corelight_vpn.yaml x: 80 commits (all time) y: 177 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml x: 280 commits (all time) y: 19 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml x: 280 commits (all time) y: 45 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/Replicator/main_aws_queue.py x: 197 commits (all time) y: 157 lines of code Solutions/DNS Essentials/Analytic Rules/MultipleErrorsReportedForSameDNSQueryStaticThresholdBased.yaml x: 152 commits (all time) y: 74 lines of code Solutions/ESET Protect Platform/Data Connectors/function_app.py x: 40 commits (all time) y: 17 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/__init__.py x: 39 commits (all time) y: 1 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/exceptions.py x: 40 commits (all time) y: 29 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/models_detections.py x: 51 commits (all time) y: 96 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml x: 90 commits (all time) y: 125 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml x: 63 commits (all time) y: 94 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml x: 93 commits (all time) y: 119 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml x: 60 commits (all time) y: 76 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml x: 60 commits (all time) y: 85 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml x: 67 commits (all time) y: 116 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml x: 59 commits (all time) y: 100 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml x: 69 commits (all time) y: 87 lines of code Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml x: 69 commits (all time) y: 110 lines of code Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml x: 42 commits (all time) y: 15 lines of code Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml x: 42 commits (all time) y: 73 lines of code Solutions/Global Secure Access/Hunting Queries/MultiTeamBot.yaml x: 42 commits (all time) y: 58 lines of code Solutions/Global Secure Access/Hunting Queries/powershell_or_nonbrowser_MailboxLogin.yaml x: 42 commits (all time) y: 50 lines of code Solutions/IllumioSaaS/Data Connectors/CommonCode/__init__.py x: 26 commits (all time) y: 1 lines of code Solutions/IllumioSaaS/Data Connectors/CommonCode/azure_storage_queue.py x: 26 commits (all time) y: 32 lines of code Solutions/IllumioSaaS/Data Connectors/CommonCode/helper.py x: 26 commits (all time) y: 21 lines of code Solutions/IllumioSaaS/Data Connectors/QueueManagerFunctionApp/queue_manager.py x: 90 commits (all time) y: 52 lines of code Solutions/IllumioSaaS/Data Connectors/QueueTriggerFuncApp/azure_queue_trigger.py x: 93 commits (all time) y: 161 lines of code Solutions/IllumioSaaS/Data Connectors/TimedSQSFunctionApp/aws_queue.py x: 96 commits (all time) y: 250 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Anomalous application user activity.yaml x: 20 commits (all time) y: 96 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Guest user exfiltration following Power Platform defense impairment.yaml x: 21 commits (all time) y: 126 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Hierarchy security manipulation.yaml x: 19 commits (all time) y: 99 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Malware found in SharePoint document management site.yaml x: 19 commits (all time) y: 90 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - TI map IP to DataverseActivity.yaml x: 20 commits (all time) y: 118 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Unusual sign-in following disabled IP address-based cookie binding protection.yaml x: 20 commits (all time) y: 108 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Power Apps - App activity from unauthorized geo.yaml x: 22 commits (all time) y: 94 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Power Apps - Bulk sharing of Power Apps to newly created guest users.yaml x: 22 commits (all time) y: 110 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Power Apps - Multiple users access a malicious link after launching new app.yaml x: 22 commits (all time) y: 203 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Power Platform - Connector added to a sensitive environment.yaml x: 22 commits (all time) y: 41 lines of code Solutions/Microsoft Business Applications/Parsers/MSBizAppsOrgSettings.yaml x: 23 commits (all time) y: 478 lines of code Solutions/Microsoft Business Applications/Parsers/MSBizAppsTerminatedEmployees.yaml x: 22 commits (all time) y: 51 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/Hunting/Automated email notifications and suspicious sign-in activity.yaml x: 34 commits (all time) y: 26 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml x: 34 commits (all time) y: 30 lines of code Solutions/Microsoft Entra ID/Analytic Rules/PrivlegedRoleAssignedOutsidePIM.yaml x: 121 commits (all time) y: 69 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Parsers/MESCompareDataOnPMRA.yaml x: 45 commits (all time) y: 183 lines of code Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml x: 83 commits (all time) y: 187 lines of code Solutions/Mimecast/Analytic Rules/MimecastSEG/MimecastCG_Impersonation.yaml x: 31 commits (all time) y: 47 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/PerformanceDetails/__init__.py x: 29 commits (all time) y: 15 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/PerformanceDetails/mimecast_performance_details_to_sentinel.py x: 29 commits (all time) y: 216 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/__init__.py x: 29 commits (all time) y: 1 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/consts.py x: 29 commits (all time) y: 58 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/sentinel.py x: 30 commits (all time) y: 249 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/state_manager.py x: 29 commits (all time) y: 30 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/utils.py x: 30 commits (all time) y: 751 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/UserData/mimecast_user_data_to_sentinel.py x: 29 commits (all time) y: 233 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/MimecastAudit/mimecast_audit_to_sentinel.py x: 30 commits (all time) y: 474 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/sentinel.py x: 30 commits (all time) y: 256 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/utils.py x: 30 commits (all time) y: 565 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/MimecastCI/mimecast_ci_to_sentinel.py x: 29 commits (all time) y: 553 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/sentinel.py x: 31 commits (all time) y: 318 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/utils.py x: 30 commits (all time) y: 628 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/MimecastDLP/mimecast_dlp_to_sentinel.py x: 29 commits (all time) y: 342 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/SharedCode/sentinel.py x: 30 commits (all time) y: 386 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/SharedCode/utils.py x: 30 commits (all time) y: 625 lines of code Solutions/Mimecast/Data Connectors/MimecastTTP/SharedCode/sentinel.py x: 31 commits (all time) y: 249 lines of code Solutions/Mimecast/Data Connectors/MimecastTTP/SharedCode/utils.py x: 30 commits (all time) y: 733 lines of code Solutions/Mimecast/Parsers/MimecastSEG/Mimecast_SEG_CG.yaml x: 29 commits (all time) y: 195 lines of code Solutions/Mimecast/Parsers/MimecastTTP/Mimecast_TTP_Url.yaml x: 29 commits (all time) y: 99 lines of code Solutions/Okta Single Sign-On/Analytic Rules/DeviceRegistrationMaliciousIP.yaml x: 141 commits (all time) y: 50 lines of code Solutions/Okta Single Sign-On/Analytic Rules/HighRiskAdminActivity.yaml x: 139 commits (all time) y: 51 lines of code Solutions/Okta Single Sign-On/Analytic Rules/MFAFatigue.yaml x: 138 commits (all time) y: 49 lines of code Solutions/Okta Single Sign-On/Analytic Rules/NewDeviceLocationCriticalOperation.yaml x: 142 commits (all time) y: 61 lines of code Solutions/Okta Single Sign-On/Parsers/OktaSSO.yaml x: 122 commits (all time) y: 157 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/FileHashEntity_Covid19_CommonSecurityLog.yaml x: 263 commits (all time) y: 70 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-UnusualThreatSignatures.yaml x: 205 commits (all time) y: 57 lines of code Solutions/PaloAlto-PAN-OS/Hunting Queries/PaloAlto-HighRiskPorts.yaml x: 205 commits (all time) y: 112 lines of code Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLConflictingMacAddress.yaml x: 191 commits (all time) y: 39 lines of code Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLFileTypeWasChanged.yaml x: 188 commits (all time) y: 36 lines of code Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLInboundRiskPorts.yaml x: 187 commits (all time) y: 33 lines of code Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleFlooding.yaml x: 203 commits (all time) y: 36 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLCriticalEventResult.yaml x: 139 commits (all time) y: 28 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLFilePermissionWithPutRequest.yaml x: 138 commits (all time) y: 26 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLIncompleteApplicationProtocol.yaml x: 138 commits (all time) y: 28 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLMultiDenyResultbyUser.yaml x: 139 commits (all time) y: 27 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedConfigVersions.yaml x: 188 commits (all time) y: 27 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRarePortsbyUser.yaml x: 169 commits (all time) y: 30 lines of code Solutions/PingFederate/Analytic Rules/PingFederateAbnormalPasswordResetsAttempts.yaml x: 226 commits (all time) y: 32 lines of code Solutions/PingFederate/Analytic Rules/PingFederateAuthFromNewSource.yaml x: 226 commits (all time) y: 42 lines of code Solutions/PingFederate/Analytic Rules/PingFederateNewUserSSO.yaml x: 228 commits (all time) y: 38 lines of code Solutions/PingFederate/Analytic Rules/PingFederateUnusualMailDomain.yaml x: 227 commits (all time) y: 44 lines of code Solutions/PingFederate/Hunting Queries/PingFederateUnusualSources.yaml x: 196 commits (all time) y: 29 lines of code Solutions/Pure Storage/Analytic Rules/FB-FabricModuleUnhealthy.yaml x: 37 commits (all time) y: 44 lines of code Solutions/Pure Storage/Parsers/PureStorageFlashArrayParser.yaml x: 37 commits (all time) y: 20 lines of code Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikAnomalyOrchestrator/__init__.py x: 79 commits (all time) y: 14 lines of code Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikEventsOrchestrator/__init__.py x: 21 commits (all time) y: 14 lines of code Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/RubrikHttpStarter/__init__.py x: 79 commits (all time) y: 55 lines of code Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/shared_code/consts.py x: 79 commits (all time) y: 10 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/SharedCode/__init__.py x: 28 commits (all time) y: 1 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/SharedCode/sentinel.py x: 30 commits (all time) y: 197 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/SharedCode/teamcymruscout_client.py x: 30 commits (all time) y: 173 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/SharedCode/utils.py x: 31 commits (all time) y: 147 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableAssetExportOrchestrator/__init__.py x: 84 commits (all time) y: 71 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableAssetExportStatusAndSendChunks/__init__.py x: 83 commits (all time) y: 75 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableCleanTables/__init__.py x: 83 commits (all time) y: 41 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableCleanUpOrchestrator/__init__.py x: 83 commits (all time) y: 13 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableComplianceExportOrchestrator/__init__.py x: 40 commits (all time) y: 87 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableExportStarter/__init__.py x: 83 commits (all time) y: 134 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableExportsOrchestrator/__init__.py x: 83 commits (all time) y: 176 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableGenerateJobStats/__init__.py x: 83 commits (all time) y: 142 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableProcessComplianceChunkFromQueue/__init__.py x: 40 commits (all time) y: 125 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableProcessFailedComplianceChunkFromQueue/__init__.py x: 40 commits (all time) y: 45 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableProcessVulnChunkFromQueue/__init__.py x: 83 commits (all time) y: 87 lines of code Solutions/Tenable App/Data Connectors/TenableVM/exports_store.py x: 84 commits (all time) y: 138 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_CloudAppEvents.yaml x: 104 commits (all time) y: 38 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml x: 105 commits (all time) y: 4 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml x: 16 commits (all time) y: 80 lines of code Solutions/Threat Intelligence/Analytic Rules/imDns_DomainEntity_DnsEvents.yaml x: 257 commits (all time) y: 109 lines of code Solutions/Tomcat/Hunting Queries/TomcatERRORs.yaml x: 56 commits (all time) y: 24 lines of code Solutions/TransmitSecurity/Data Connectors/TransmitSecurityConnector/__init__.py x: 65 commits (all time) y: 126 lines of code Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneAttackDiscoveryDetectionRisks.yaml x: 193 commits (all time) y: 33 lines of code Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneCommandLineSuspiciousRequests.yaml x: 190 commits (all time) y: 34 lines of code Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneDvcAccessPermissionWasChanged.yaml x: 203 commits (all time) y: 46 lines of code Solutions/Trend Micro Apex One/Analytic Rules/TMApexOnePossibleExploitOrExecuteOperation.yaml x: 227 commits (all time) y: 36 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedAction.yaml x: 135 commits (all time) y: 45 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTranslatedOperation.yaml x: 172 commits (all time) y: 46 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneBehaviorMonitoringTypesOfEvent.yaml x: 135 commits (all time) y: 38 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneChannelType.yaml x: 172 commits (all time) y: 75 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneRareAppProtocolByIP.yaml x: 190 commits (all time) y: 148 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneSpywareDetection.yaml x: 135 commits (all time) y: 27 lines of code Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiL2RFTP.yaml x: 121 commits (all time) y: 36 lines of code Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiL2RLargeIcmp.yaml x: 83 commits (all time) y: 43 lines of code Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiUnusualTraffic.yaml x: 123 commits (all time) y: 31 lines of code Solutions/Ubiquiti UniFi/Hunting Queries/UbiquitiDnsTimeOut.yaml x: 83 commits (all time) y: 27 lines of code Solutions/Ubiquiti UniFi/Hunting Queries/UbiquitiUnusualSubdomains.yaml x: 124 commits (all time) y: 29 lines of code Solutions/VMWareESXi/Analytic Rules/ESXiDormantVMStarted.yaml x: 177 commits (all time) y: 57 lines of code Solutions/VMWareESXi/Analytic Rules/ESXiMultipleVMStopped.yaml x: 178 commits (all time) y: 43 lines of code Solutions/VMWareESXi/Analytic Rules/ESXiRootLogin.yaml x: 125 commits (all time) y: 40 lines of code Solutions/VMWareESXi/Hunting Queries/ESXiNFCDownloadActivities.yaml x: 94 commits (all time) y: 27 lines of code Solutions/VMWareESXi/Hunting Queries/ESXiUnusedVMs.yaml x: 94 commits (all time) y: 57 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Account-Detections.yaml x: 182 commits (all time) y: 94 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Account-by-Severity.yaml x: 263 commits (all time) y: 37 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-HighSeverityDetection-by-Tactics.yaml x: 263 commits (all time) y: 114 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Host-by-Severity.yaml x: 263 commits (all time) y: 87 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml x: 309 commits (all time) y: 62 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Suspected-Behavior-by-Tactics.yaml x: 265 commits (all time) y: 100 lines of code Solutions/Vectra AI Stream/Parsers/vectra_match.yaml x: 20 commits (all time) y: 17 lines of code Solutions/ZeroNetworks/Parsers/ZNSegmentAudit.yaml x: 95 commits (all time) y: 208 lines of code Solutions/Zscaler Internet Access/Analytic Rules/Zscaler-LowVolumeDomainRequests.yaml x: 189 commits (all time) y: 53 lines of code Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedCountEventResult.yaml x: 129 commits (all time) y: 33 lines of code Solutions/Zscaler Private Access (ZPA)/Hunting Queries/ZscalerAbnormalTotalBytesSize.yaml x: 52 commits (all time) y: 26 lines of code Solutions/Zscaler Private Access (ZPA)/Hunting Queries/ZscalerTopSourceIP.yaml x: 50 commits (all time) y: 25 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logAnalyticsAadTokenProvider.rb x: 167 commits (all time) y: 71 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logAnalyticsClient.rb x: 175 commits (all time) y: 102 lines of code Detections/CommonSecurityLog/TimeSeriesAnomaly-MultiVendor_NetworkTraffic.yaml x: 231 commits (all time) y: 92 lines of code Detections/MultipleDataSources/StarBlizzardDomainsAugust2022.yaml x: 141 commits (all time) y: 117 lines of code Detections/SecurityEvent/RDP_Nesting.yaml x: 290 commits (all time) y: 159 lines of code Detections/SigninLogs/ExplicitMFADeny.yaml x: 305 commits (all time) y: 5 lines of code Detections/ZoomLogs/SupiciousLinkSharing.yaml x: 267 commits (all time) y: 46 lines of code Hunting Queries/Microsoft 365 Defender/Discovery/MDI_Find_deleted_accounts_and_by_whom.yaml x: 31 commits (all time) y: 27 lines of code Hunting Queries/Microsoft 365 Defender/Discovery/MDI_Group_Memebership_Changes.yaml x: 34 commits (all time) y: 45 lines of code Hunting Queries/MultipleDataSources/HighRiskSignInAroundAuthMethodOrDeviceRegistration.yaml x: 16 commits (all time) y: 61 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventBarracudaCEF.yaml x: 22 commits (all time) y: 160 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventBarracudaWAF.yaml x: 91 commits (all time) y: 159 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCiscoMeraki.yaml x: 84 commits (all time) y: 219 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCiscoMerakiSyslog.yaml x: 19 commits (all time) y: 225 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventMicrosoftWindowsEvents.yaml x: 235 commits (all time) y: 196 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventBarracudaWAF.yaml x: 92 commits (all time) y: 205 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventCiscoMeraki.yaml x: 84 commits (all time) y: 257 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventCiscoMerakiSyslog.yaml x: 19 commits (all time) y: 263 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftEvent.yaml x: 31 commits (all time) y: 260 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftSecurityEvents.yaml x: 30 commits (all time) y: 288 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftWindowsEvents.yaml x: 222 commits (all time) y: 282 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoMeraki.yaml x: 111 commits (all time) y: 146 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoMerakiSyslog.yaml x: 25 commits (all time) y: 155 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationOktaOSS.yaml x: 299 commits (all time) y: 113 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationOktaV2.yaml x: 36 commits (all time) y: 165 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoMeraki.yaml x: 131 commits (all time) y: 224 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoMerakiSyslog.yaml x: 24 commits (all time) y: 232 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationOktaOSS.yaml x: 298 commits (all time) y: 189 lines of code Parsers/ASimDns/Parsers/ASimDnsMicrosoftSysmon.yaml x: 161 commits (all time) y: 118 lines of code Parsers/ASimDns/Parsers/vimDnsMicrosoftSysmon.yaml x: 114 commits (all time) y: 180 lines of code Parsers/ASimDns/Parsers/vimDnsMicrosoftSysmonWindowsEvent.yaml x: 30 commits (all time) y: 165 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEvent.yaml x: 213 commits (all time) y: 64 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftSecurityEvents.yaml x: 25 commits (all time) y: 81 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftSysmon.yaml x: 88 commits (all time) y: 104 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftSysmonWindowsEvent.yaml x: 32 commits (all time) y: 96 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftWindowsEvents.yaml x: 92 commits (all time) y: 91 lines of code Parsers/ASimFileEvent/Parsers/imFileEvent.yaml x: 287 commits (all time) y: 109 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventMicrosoftSecurityEvents.yaml x: 33 commits (all time) y: 184 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventMicrosoftSysmon.yaml x: 128 commits (all time) y: 178 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventMicrosoftWindowsEvents.yaml x: 123 commits (all time) y: 190 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionBarracudaWAF.yaml x: 96 commits (all time) y: 132 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoMeraki.yaml x: 258 commits (all time) y: 382 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoMerakiSyslog.yaml x: 20 commits (all time) y: 386 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml x: 87 commits (all time) y: 126 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftWindowsEventFirewall.yaml x: 282 commits (all time) y: 135 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionBarracudaCEF.yaml x: 24 commits (all time) y: 205 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionBarracudaWAF.yaml x: 96 commits (all time) y: 204 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoMeraki.yaml x: 258 commits (all time) y: 450 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoMerakiSyslog.yaml x: 20 commits (all time) y: 454 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSecurityEventFirewall.yaml x: 37 commits (all time) y: 295 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSysmon.yaml x: 20 commits (all time) y: 204 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSysmonWindowsEvent.yaml x: 20 commits (all time) y: 195 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftWindowsEventFirewall.yaml x: 296 commits (all time) y: 196 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessCreateMicrosoftSysmon.yaml x: 138 commits (all time) y: 131 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessCreateMicrosoftSysmonWindowsEvent.yaml x: 22 commits (all time) y: 114 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessTerminateMicrosoftSysmon.yaml x: 135 commits (all time) y: 83 lines of code Parsers/ASimProcessEvent/Parsers/imProcessEvent.yaml x: 194 commits (all time) y: 106 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftSysmon.yaml x: 169 commits (all time) y: 215 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftSysmonWidowsEvent.yaml x: 21 commits (all time) y: 200 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMicrosoftSysmon.yaml x: 160 commits (all time) y: 146 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMicrosoftSysmonWindowsEvent.yaml x: 15 commits (all time) y: 161 lines of code Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventMicrosoftSysmon.yaml x: 82 commits (all time) y: 141 lines of code Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventMicrosoftSysmonWindowsEvent.yaml x: 27 commits (all time) y: 111 lines of code Parsers/ASimRegistryEvent/Parsers/imRegistryEvent.yaml x: 24 commits (all time) y: 88 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoftSecurityEvent.yaml x: 37 commits (all time) y: 172 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoftSysmon.yaml x: 126 commits (all time) y: 173 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoftWindowsEvent.yaml x: 173 commits (all time) y: 176 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagement.yaml x: 173 commits (all time) y: 51 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementMicrosoftSecurityEvent.yaml x: 108 commits (all time) y: 205 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementMicrosoftWindowsEvent.yaml x: 33 commits (all time) y: 161 lines of code Parsers/ASimUserManagement/Parsers/imUserManagement.yaml x: 202 commits (all time) y: 81 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementMicrosoftSecurityEvent.yaml x: 141 commits (all time) y: 257 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementMicrosoftWindowsEvent.yaml x: 35 commits (all time) y: 243 lines of code Parsers/ASimWebSession/Parsers/ASimWebSession.yaml x: 516 commits (all time) y: 64 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionBarracudaWAF.yaml x: 98 commits (all time) y: 195 lines of code Parsers/ASimWebSession/Parsers/imWebSession.yaml x: 523 commits (all time) y: 105 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionBarracudaWAF.yaml x: 98 commits (all time) y: 262 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/sentinel.py x: 25 commits (all time) y: 150 lines of code Solutions/CiscoMeraki/Parsers/CiscoMeraki.yaml x: 127 commits (all time) y: 246 lines of code Solutions/DNS Essentials/Hunting Queries/AnomalousIncreaseInDNSActivityByClients.yaml x: 96 commits (all time) y: 119 lines of code Solutions/DNS Essentials/Hunting Queries/ConnectionToUnpopularWebsiteDetected.yaml x: 94 commits (all time) y: 118 lines of code Solutions/DNS Essentials/Hunting Queries/DNSQueryWithFailuresInLast24Hours.yaml x: 100 commits (all time) y: 26 lines of code Solutions/Digital Guardian Data Loss Prevention/Parsers/DigitalGuardianDLPEvent.yaml x: 32 commits (all time) y: 31 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/ClassicReverseIP/__init__.py x: 33 commits (all time) y: 74 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/DomainSearch/__init__.py x: 33 commits (all time) y: 113 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/EnrichDomain/__init__.py x: 33 commits (all time) y: 306 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/InvestigateDomain/__init__.py x: 33 commits (all time) y: 458 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/ParsedWhois/__init__.py x: 33 commits (all time) y: 111 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/PivotByMXIP/__init__.py x: 33 commits (all time) y: 95 lines of code Solutions/ESETPROTECT/Analytic Rules/ESETThreatDetected.yaml x: 165 commits (all time) y: 45 lines of code Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml x: 117 commits (all time) y: 48 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/FetchAndSendDetections/__init__.py x: 56 commits (all time) y: 86 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/FetchAndSendDetectionsHistory/__init__.py x: 65 commits (all time) y: 101 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/OrchestratorWatchdog/__init__.py x: 92 commits (all time) y: 150 lines of code Solutions/Fortinet FortiNDR Cloud/Parsers/Fortinet_FortiNDR_Cloud.yaml x: 90 commits (all time) y: 357 lines of code Solutions/GoogleCloudPlatformIAM/Analytic Rules/GCPIAMHighPrivilegedRoleAdded.yaml x: 116 commits (all time) y: 43 lines of code Solutions/Illusive Platform/Analytic Rules/Illusive_Detection_Query.yaml x: 189 commits (all time) y: 67 lines of code Solutions/Infoblox NIOS/Parsers/Infoblox_dnsclient.yaml x: 91 commits (all time) y: 67 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/AzureStorageToIndicators/create_indicator.py x: 24 commits (all time) y: 167 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/AzureStorageToIndicators/indicator_mapping.py x: 24 commits (all time) y: 149 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxCurrentToAzureStorage/__init__.py x: 24 commits (all time) y: 35 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxCurrentToAzureStorage/infoblox_to_azure_storage.py x: 24 commits (all time) y: 519 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxDossierHttpStarter/__init__.py x: 24 commits (all time) y: 65 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxDossierJobResult/get_dossier_result.py x: 24 commits (all time) y: 170 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxDossierOrchestrator/create_dossier_job.py x: 25 commits (all time) y: 105 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxHistoricalToAzureStorage/infoblox_to_azure_storage.py x: 24 commits (all time) y: 538 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxParseRawIndicators/parse_json_files.py x: 24 commits (all time) y: 372 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/RetryFailedIndicators/retry_failed_indicators.py x: 26 commits (all time) y: 89 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/SharedCode/__init__.py x: 24 commits (all time) y: 1 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/SharedCode/consts.py x: 24 commits (all time) y: 110 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/SharedCode/utils.py x: 25 commits (all time) y: 948 lines of code Solutions/Microsoft 365/Analytic Rules/sharepoint_file_transfer_folders_above_threshold.yaml x: 244 commits (all time) y: 59 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/General/MDO daily detection summary report.yaml x: 23 commits (all time) y: 65 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/URL/Phishing Email Url Redirector.yaml x: 23 commits (all time) y: 6 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SuccessThenFail_DiffIP_SameUserandApp.yaml x: 189 commits (all time) y: 107 lines of code Solutions/MicrosoftDefenderForEndpoint/Analytic Rules/AquaBlizzardAVHits.yaml x: 78 commits (all time) y: 58 lines of code Solutions/Recorded Future/Analytic Rules/RecordedFutureDomainMalwareC2inDNSEvents.yaml x: 210 commits (all time) y: 59 lines of code Solutions/Recorded Future/Analytic Rules/RecordedFutureHashObservedInUndergroundinCommonSecurityLog.yaml x: 145 commits (all time) y: 46 lines of code Solutions/Recorded Future/Analytic Rules/RecordedFutureIPMalwareC2inAzureActivityEvents.yaml x: 125 commits (all time) y: 24 lines of code Solutions/Recorded Future/Analytic Rules/RecordedFutureIPMalwareC2inDNSEvents.yaml x: 153 commits (all time) y: 44 lines of code Solutions/SonraiSecurity/Analytic Rules/SonraiTicketRiskAccepted.yaml x: 161 commits (all time) y: 5 lines of code Solutions/Sophos XG Firewall/Parsers/SophosXGFirewall.yaml x: 97 commits (all time) y: 77 lines of code Solutions/Symantec Endpoint Protection/Parsers/SymantecEndpointProtection.yaml x: 114 commits (all time) y: 186 lines of code Solutions/SymantecProxySG/Parsers/SymantecProxySG.yaml x: 145 commits (all time) y: 22 lines of code Solutions/Theom/Analytic Rules/TheomRisksCritical.yaml x: 125 commits (all time) y: 58 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_AuditLogs.yaml x: 250 commits (all time) y: 77 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml x: 97 commits (all time) y: 4 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_OfficeActivity.yaml x: 247 commits (all time) y: 53 lines of code Solutions/UEBA Essentials/Hunting Queries/Anomalous Sign-in Activity.yaml x: 173 commits (all time) y: 8 lines of code Solutions/Vectra XDR/Data Connectors/VectraDataConnector/EntityScoring/entity_scoring_collector.py x: 80 commits (all time) y: 48 lines of code Solutions/Vectra XDR/Data Connectors/VectraDataConnector/SharedCode/collector.py x: 135 commits (all time) y: 1099 lines of code Solutions/Vectra XDR/Data Connectors/VectraDataConnector/SharedCode/consts.py x: 133 commits (all time) y: 65 lines of code Solutions/Vectra XDR/Data Connectors/VectraDataConnector/SharedCode/keyvault_secrets_management.py x: 21 commits (all time) y: 32 lines of code Solutions/Vectra XDR/Parsers/VectraDetections.yaml x: 89 commits (all time) y: 71 lines of code Solutions/Vectra XDR/Parsers/VectraEntityScoring.yaml x: 89 commits (all time) y: 59 lines of code Solutions/ZeroFox/Data Connectors/CTI/AzureFunctionZeroFoxCTI/botnet_compromised_credentials_connector/__init__.py x: 79 commits (all time) y: 56 lines of code Solutions/ZeroFox/Data Connectors/CTI/AzureFunctionZeroFoxCTI/connections/sentinel.py x: 76 commits (all time) y: 136 lines of code Solutions/ZeroFox/Data Connectors/CTI/AzureFunctionZeroFoxCTI/connections/zerofox.py x: 74 commits (all time) y: 79 lines of code Solutions/iboss/Parsers/ibossUrlEvent.yaml x: 91 commits (all time) y: 42 lines of code Tools/AzureDataExplorer/CreateTables_ADX_ScriptFile/Create-LA-Tables-ADX-ScriptFile.ps1 x: 28 commits (all time) y: 392 lines of code Tools/Copy-AzOperationalInsightsTable/Copy-AzOperationalInsightsTable.ps1 x: 28 commits (all time) y: 123 lines of code Tools/Create-Azure-Sentinel-Solution/pipeline/createSolutionV4.ps1 x: 371 commits (all time) y: 305 lines of code Tools/Sentinel-All-In-One/v2/Scripts/Create-NewSolutionAndRulesFromList.ps1 x: 204 commits (all time) y: 187 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationBarracudaWAF.yaml x: 79 commits (all time) y: 215 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationBarracudaWAF.yaml x: 109 commits (all time) y: 315 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionCiscoMeraki.yaml x: 71 commits (all time) y: 186 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionCiscoMeraki.yaml x: 71 commits (all time) y: 248 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Parsers/CrowdstrikeFalconEventStream.yaml x: 70 commits (all time) y: 67 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/services/workbench_service.py x: 193 commits (all time) y: 219 lines of code Solutions/Microsoft 365/Analytic Rules/External User added to Team and immediately uploads file.yaml x: 192 commits (all time) y: 88 lines of code DataConnectors/M365Defender-VulnerabilityManagement/functionPackage/GetMDVMData/run.ps1 x: 190 commits (all time) y: 243 lines of code DataConnectors/M365Defender-VulnerabilityManagement/functionPackage/requirements.psd1 x: 103 commits (all time) y: 10 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin.rb x: 156 commits (all time) y: 56 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logstashLoganalyticsConfiguration.rb x: 157 commits (all time) y: 193 lines of code Detections/ASimAuthentication/imAuthSigninsMultipleCountries.yaml x: 264 commits (all time) y: 69 lines of code Detections/ASimProcess/imProcess_SolarWinds_SUNBURST_Process-IOCs.yaml x: 216 commits (all time) y: 34 lines of code Detections/ASimWebSession/UnusualUACryptoMiners.yaml x: 209 commits (all time) y: 71 lines of code Detections/ASimWebSession/UnusualUAHackTool.yaml x: 247 commits (all time) y: 82 lines of code Detections/DuoSecurity/TrustMonitorEvent.yaml x: 122 commits (all time) y: 44 lines of code Detections/Heartbeat/MissingDCHearbeat.yaml x: 146 commits (all time) y: 48 lines of code Detections/Heartbeat/OMI_vulnerability_detection.yaml x: 211 commits (all time) y: 56 lines of code Detections/MultipleDataSources/RiskyUserIn3Pnetworkactivity.yaml x: 231 commits (all time) y: 98 lines of code Detections/MultipleDataSources/SecurityServiceRegistryACLModification.yaml x: 222 commits (all time) y: 142 lines of code Hunting Queries/AuditLogs/ApprovedAccessPackagesDetails.yaml x: 40 commits (all time) y: 61 lines of code Solutions/1Password/Analytics Rules/1Password - Changes to SSO configuration.yaml x: 68 commits (all time) y: 51 lines of code Solutions/1Password/Analytics Rules/1Password - Non-privileged vault user permission change.yaml x: 49 commits (all time) y: 65 lines of code Solutions/1Password/Analytics Rules/1Password - Secret Extraction Post Vault Access Change By Administrator.yaml x: 52 commits (all time) y: 78 lines of code Solutions/1Password/Analytics Rules/1Password - Vault Export Post Account Creation.yaml x: 52 commits (all time) y: 63 lines of code Solutions/1Password/Analytics Rules/1Password - Vault Export.yaml x: 52 commits (all time) y: 48 lines of code Solutions/1Password/Data Connectors/Modules/HelperFunctions/HelperFunctions.psm1 x: 46 commits (all time) y: 351 lines of code Solutions/1Password/Data Connectors/function/run.ps1 x: 46 commits (all time) y: 61 lines of code Solutions/1Password/Data Connectors/profile.ps1 x: 46 commits (all time) y: 19 lines of code Solutions/1Password/Data Connectors/requirements.psd1 x: 46 commits (all time) y: 9 lines of code Solutions/42Crunch API Protection/Analytic Rules/APIAPIScaping.yaml x: 71 commits (all time) y: 46 lines of code Solutions/42Crunch API Protection/Analytic Rules/APIKiterunnerDetection.yaml x: 72 commits (all time) y: 47 lines of code Solutions/ARGOSCloudSecurity/Analytic Rules/ExploitableSecurityIssues.yaml x: 128 commits (all time) y: 45 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_ClearStopChangeTrailLogs.yaml x: 183 commits (all time) y: 52 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_FullAdminPolicyAttachedToRolesUsersGroups.yaml x: 219 commits (all time) y: 87 lines of code Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/Log4J_IPIOC_Dec112021.yaml x: 207 commits (all time) y: 219 lines of code Solutions/Authomize/Analytic Rules/Chain_of_3_or_more_roles.yaml x: 136 commits (all time) y: 58 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Deny Rate for Source IP.yaml x: 184 commits (all time) y: 86 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml x: 180 commits (all time) y: 82 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Multiple Sources Affected by the Same TI Destination.yaml x: 237 commits (all time) y: 51 lines of code Solutions/BitSight/Analytic Rules/BitSightNewAlertFound.yaml x: 98 commits (all time) y: 45 lines of code Solutions/CTM360/Analytic Rules/BrandAbuse.yaml x: 120 commits (all time) y: 47 lines of code Solutions/CTM360/Analytic Rules/CookiesSamesiteFlagNotUsed.yaml x: 121 commits (all time) y: 49 lines of code Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelIPSEventThreshold.yaml x: 109 commits (all time) y: 38 lines of code Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelIntrusionEvents.yaml x: 108 commits (all time) y: 36 lines of code Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMalwareEvents.yaml x: 111 commits (all time) y: 55 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaConnectionNon-CorporatePrivateNetwork.yaml x: 214 commits (all time) y: 33 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaConnectionToUnpopularWebsiteDetected.yaml x: 182 commits (all time) y: 44 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaRequestAllowedHarmfulMaliciousURICategory.yaml x: 164 commits (all time) y: 54 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaRequestBlocklistedFileType.yaml x: 142 commits (all time) y: 40 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaURIContainsIPAddress.yaml x: 164 commits (all time) y: 37 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/Signins-From-VPS-Providers.yaml x: 292 commits (all time) y: 8 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/CofenseBasedIndicatorCreator/cofense_to_sentinel_mapping.py x: 134 commits (all time) y: 323 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/CofenseBasedIndicatorCreator/sentinel.py x: 134 commits (all time) y: 193 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/RetryFailedIndicators/__init__.py x: 43 commits (all time) y: 13 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/RetryFailedIndicators/retry_failed_indicators.py x: 43 commits (all time) y: 270 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/RetryFailedIndicators/sentinel.py x: 43 commits (all time) y: 193 lines of code Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml x: 154 commits (all time) y: 67 lines of code Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml x: 224 commits (all time) y: 35 lines of code Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml x: 105 commits (all time) y: 47 lines of code Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_CodeLevelVulnerabilityDetection.yaml x: 200 commits (all time) y: 70 lines of code Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_NonCriticalVulnerabilityDetection.yaml x: 197 commits (all time) y: 65 lines of code Solutions/Dynatrace/Analytic Rules/Dynatrace_ProblemDetection.yaml x: 154 commits (all time) y: 54 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml x: 150 commits (all time) y: 49 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/malware_in_recyclebin.yaml x: 162 commits (all time) y: 71 lines of code Solutions/Eset Security Management Center/Analytic Rules/eset-sites-blocked.yaml x: 64 commits (all time) y: 45 lines of code Solutions/Eset Security Management Center/Analytic Rules/eset-threats.yaml x: 64 commits (all time) y: 41 lines of code Solutions/FalconFriday/Analytic Rules/ExcessiveSharePermissions.yaml x: 102 commits (all time) y: 95 lines of code Solutions/Forescout (Legacy)/Parsers/ForescoutEvent.yaml x: 43 commits (all time) y: 23 lines of code Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_DnsEvents.yaml x: 131 commits (all time) y: 79 lines of code Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_SigninLogs.yaml x: 100 commits (all time) y: 65 lines of code Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_imNetworkSession.yaml x: 151 commits (all time) y: 130 lines of code Solutions/IPinfo/Data Connectors/Company/AzureFunctionIPinfoCompany/utils.py x: 42 commits (all time) y: 153 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/Manganese_VPN-IOCs.yaml x: 87 commits (all time) y: 4 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/PossiblePhishingwithCSL&NetworkSession.yaml x: 138 commits (all time) y: 147 lines of code Solutions/Microsoft Entra ID/Analytic Rules/ADFSDomainTrustMods.yaml x: 148 commits (all time) y: 91 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AccountCreatedDeletedByNonApprovedUser.yaml x: 116 commits (all time) y: 61 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AzureADRoleManagementPermissionGrant.yaml x: 117 commits (all time) y: 58 lines of code Solutions/Microsoft Entra ID/Analytic Rules/CredentialAddedAfterAdminConsent.yaml x: 116 commits (all time) y: 153 lines of code Solutions/Microsoft Entra ID/Analytic Rules/NRT_ADFSDomainTrustMods.yaml x: 132 commits (all time) y: 72 lines of code Solutions/ProofPointTap/Analytic Rules/MalwareAttachmentDelivered.yaml x: 221 commits (all time) y: 52 lines of code Solutions/Radiflow/Analytic Rules/RadiflowNewActivityDetected.yaml x: 46 commits (all time) y: 37 lines of code Solutions/Radiflow/Analytic Rules/RadiflowPlatformAlert.yaml x: 47 commits (all time) y: 84 lines of code Solutions/Radiflow/Parsers/RadiflowEvent.yaml x: 44 commits (all time) y: 78 lines of code Solutions/Red Canary/Analytic Rules/RedCanaryThreatDetection.yaml x: 57 commits (all time) y: 132 lines of code Solutions/RidgeSecurity/Analytic Rules/RidgeSecurity_Risks.yaml x: 101 commits (all time) y: 42 lines of code Solutions/SlackAudit/Analytic Rules/SlackAuditUnknownUA.yaml x: 168 commits (all time) y: 34 lines of code Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml x: 111 commits (all time) y: 33 lines of code Solutions/Tenable App/Parsers/TenableVMAssets.yaml x: 44 commits (all time) y: 129 lines of code Solutions/Tenable App/Parsers/TenableVMVulnerabilities.yaml x: 44 commits (all time) y: 220 lines of code Solutions/Tenable App/Parsers/afad_parser.yaml x: 45 commits (all time) y: 117 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml x: 246 commits (all time) y: 40 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml x: 128 commits (all time) y: 59 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_PaloAlto.yaml x: 259 commits (all time) y: 65 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml x: 297 commits (all time) y: 79 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_Syslog.yaml x: 264 commits (all time) y: 91 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_imWebSession.yaml x: 245 commits (all time) y: 50 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_AzureActivity.yaml x: 228 commits (all time) y: 70 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_EmailEvents.yaml x: 103 commits (all time) y: 58 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_OfficeActivity.yaml x: 229 commits (all time) y: 70 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 210 commits (all time) y: 91 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_SigninLogs.yaml x: 226 commits (all time) y: 77 lines of code Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CommonSecurityLog.yaml x: 224 commits (all time) y: 85 lines of code Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_DeviceFileEvents.yaml x: 85 commits (all time) y: 66 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AppServiceHTTPLogs.yaml x: 300 commits (all time) y: 92 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AzureActivity.yaml x: 312 commits (all time) y: 86 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AzureFirewall.yaml x: 248 commits (all time) y: 78 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AzureKeyVault.yaml x: 293 commits (all time) y: 70 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AzureNetworkAnalytics.yaml x: 266 commits (all time) y: 79 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AzureSQL.yaml x: 246 commits (all time) y: 70 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_DnsEvents.yaml x: 264 commits (all time) y: 77 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_DuoSecurity.yaml x: 218 commits (all time) y: 54 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_OfficeActivity.yaml x: 278 commits (all time) y: 75 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_SigninLogs.yaml x: 169 commits (all time) y: 75 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_VMConnection.yaml x: 245 commits (all time) y: 73 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_imNetworkSession.yaml x: 172 commits (all time) y: 122 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_DeviceNetworkEvents.yaml x: 114 commits (all time) y: 73 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_EmailUrlInfo.yaml x: 102 commits (all time) y: 69 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_SecurityAlerts.yaml x: 218 commits (all time) y: 71 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_Syslog.yaml x: 207 commits (all time) y: 31 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_UrlClickEvents.yaml x: 102 commits (all time) y: 72 lines of code Solutions/Threat Intelligence/Analytic Rules/imDns_IPEntity_DnsEvents.yaml x: 212 commits (all time) y: 103 lines of code Solutions/ThreatConnect/Analytic Rules/ThreatConnect_DomainEntity_DnsEvents.yaml x: 118 commits (all time) y: 92 lines of code Solutions/ThreatConnect/Analytic Rules/ThreatConnect_IPEntity_NetworkSessions.yaml x: 128 commits (all time) y: 80 lines of code Solutions/Trend Micro Vision One/Analytic Rules/Create Incident for XDR Alerts.yaml x: 123 commits (all time) y: 89 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/transform_utils.py x: 144 commits (all time) y: 293 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Constants.cs x: 38 commits (all time) y: 13 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/DatAlert/DatAlertClient.cs x: 74 commits (all time) y: 143 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/DatAlert/DatAlertParams.cs x: 72 commits (all time) y: 13 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/FetchDataFunction.cs x: 77 commits (all time) y: 72 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Helpers/CustomParser.cs x: 73 commits (all time) y: 25 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Helpers/SearchAlertObjectMapper.cs x: 74 commits (all time) y: 104 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Search/Model/AlertAttributes.cs x: 73 commits (all time) y: 86 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Search/Model/AlertItem.cs x: 74 commits (all time) y: 39 lines of code Solutions/ZeroFox/Data Connectors/CTI/AzureFunctionZeroFoxCTI/connections/__init__.py x: 44 commits (all time) y: 1 lines of code DataConnectors/AWS-S3/Enviornment/EnviornmentConstants.ps1 x: 103 commits (all time) y: 20 lines of code Detections/ASimDNS/imDns_HighNXDomainCount_detection.yaml x: 198 commits (all time) y: 83 lines of code Detections/ASimWebSession/ExcessiveNetworkFailuresFromSource.yaml x: 209 commits (all time) y: 62 lines of code Detections/ASimWebSession/PossibleDGAContacts.yaml x: 267 commits (all time) y: 57 lines of code Detections/AzureActivity/RareRunCommandPowerShellScript.yaml x: 329 commits (all time) y: 80 lines of code Detections/CommonSecurityLog/Fortinet-NetworkBeaconPattern.yaml x: 197 commits (all time) y: 85 lines of code Detections/LAQueryLogs/UserSearchingForVIPUserActivity.yaml x: 241 commits (all time) y: 50 lines of code Detections/MultipleDataSources/AAD_PAVPN_Correlation.yaml x: 258 commits (all time) y: 86 lines of code Detections/MultipleDataSources/AuditPolicyManipulation_using_auditpol.yaml x: 238 commits (all time) y: 79 lines of code Detections/MultipleDataSources/B64IPInURLFromMDE.yaml x: 94 commits (all time) y: 72 lines of code Detections/MultipleDataSources/ExchangeWorkerProcessMakingRemoteCall.yaml x: 195 commits (all time) y: 70 lines of code Detections/MultipleDataSources/MalformedUserAgents.yaml x: 307 commits (all time) y: 109 lines of code Detections/MultipleDataSources/MultiplePasswordresetsbyUser.yaml x: 343 commits (all time) y: 136 lines of code Detections/MultipleDataSources/PrestigeRansomwareIOCsOct22.yaml x: 165 commits (all time) y: 124 lines of code Detections/MultipleDataSources/RunCommandUEBABreach.yaml x: 334 commits (all time) y: 79 lines of code Detections/MultipleDataSources/SigninFirewallCorrelation.yaml x: 301 commits (all time) y: 67 lines of code Detections/MultipleDataSources/SuspiciousModificationofGlobalAdminProperties.yaml x: 202 commits (all time) y: 88 lines of code Detections/MultipleDataSources/SuspiciousVMInstanceCreationActivity.yaml x: 171 commits (all time) y: 141 lines of code Detections/MultipleDataSources/TimeSeriesAnomaly-MultiVendor_DataExfiltration.yaml x: 275 commits (all time) y: 123 lines of code Detections/SecurityAlert/Dev-0530AVHits.yaml x: 194 commits (all time) y: 59 lines of code Detections/SecurityAlert/EuropiumAVHits.yaml x: 192 commits (all time) y: 60 lines of code Detections/SecurityAlert/MDE_hitsforADFandAzureSynapsePipelines.yaml x: 168 commits (all time) y: 61 lines of code Detections/SecurityEvent/GroupCreatedAddedToPrivlegeGroup_1h.yaml x: 307 commits (all time) y: 150 lines of code Detections/SecurityEvent/UserAccountAddedToPrivlegeGroup_1h.yaml x: 351 commits (all time) y: 112 lines of code Detections/SecurityEvent/UserAccountCreatedDeleted_10m.yaml x: 285 commits (all time) y: 148 lines of code Detections/SecurityEvent/UserAccountEnabledDisabled_10m.yaml x: 304 commits (all time) y: 149 lines of code Detections/W3CIISLog/HighFailedLogonCountByClientIP.yaml x: 216 commits (all time) y: 92 lines of code Detections/W3CIISLog/HighPortCountByClientIP.yaml x: 181 commits (all time) y: 80 lines of code Detections/W3CIISLog/ProxyShellPwn2Own.yaml x: 140 commits (all time) y: 65 lines of code Detections/ZoomLogs/E2EEDisbaled.yaml x: 197 commits (all time) y: 42 lines of code Detections/ZoomLogs/JoiningMeetingFromAnotherTimeZone.yaml x: 262 commits (all time) y: 58 lines of code Detections/http_proxy_oab_CL/SilkTyphoonSuspiciousFileDownloads.yaml x: 76 commits (all time) y: 46 lines of code Hunting Queries/Microsoft 365 Defender/Execution/detect-impacket-atexec.yaml x: 39 commits (all time) y: 36 lines of code Hunting Queries/Microsoft 365 Defender/Execution/detect-impacket-psexec-module.yaml x: 32 commits (all time) y: 50 lines of code Hunting Queries/Microsoft 365 Defender/Initial access/ActiveDirectory_Account_lockout_and_unlocks.yaml x: 67 commits (all time) y: 25 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationPostgreSQL.yaml x: 174 commits (all time) y: 187 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationSentinelOne.yaml x: 91 commits (all time) y: 227 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAWSCloudTrail.yaml x: 214 commits (all time) y: 223 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoASA.yaml x: 133 commits (all time) y: 351 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoISE.yaml x: 141 commits (all time) y: 352 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftMD4IoT.yaml x: 132 commits (all time) y: 144 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationPaloAltoCortexDataLake.yaml x: 68 commits (all time) y: 253 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationPostgreSQL.yaml x: 223 commits (all time) y: 494 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSentinelOne.yaml x: 94 commits (all time) y: 323 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSshd.yaml x: 163 commits (all time) y: 337 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationVMwareCarbonBlackCloud.yaml x: 72 commits (all time) y: 155 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationVectraXDRAudit.yaml x: 91 commits (all time) y: 136 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionSonicWallFirewall.yaml x: 28 commits (all time) y: 407 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionSonicWallFirewall.yaml x: 30 commits (all time) y: 457 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_ChangeToVPC.yaml x: 161 commits (all time) y: 53 lines of code Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/AzureWAFmatching_log4j_vuln.yaml x: 131 commits (all time) y: 47 lines of code Solutions/AtlassianJiraAudit/Data Connectors/JiraAuditAPISentinelConnector/__init__.py x: 111 commits (all time) y: 118 lines of code Solutions/AtlassianJiraAudit/Playbooks/Sync-CommentsFunctionApp/Sync-Comment.ps1 x: 71 commits (all time) y: 87 lines of code Solutions/Auth0/Data Connectors/Auth0Connector/main.py x: 226 commits (all time) y: 321 lines of code Solutions/Azure Key Vault/Analytic Rules/KeyvaultMassSecretRetrieval.yaml x: 185 commits (all time) y: 80 lines of code Solutions/Azure Key Vault/Analytic Rules/TimeSeriesKeyvaultAccessAnomaly.yaml x: 165 commits (all time) y: 85 lines of code Solutions/Azure SQL Database solution for sentinel/Analytic Rules/Detection-VolumeAffectedRowsStatefulAnomalyOnDatabase.yaml x: 117 commits (all time) y: 84 lines of code Solutions/Azure SQL Database solution for sentinel/Analytic Rules/Detection-VolumeResponseRowsStatefulAnomalyOnDatabase.yaml x: 117 commits (all time) y: 83 lines of code Solutions/Azure Web Application Firewall (WAF)/Analytic Rules/MaliciousWAFSessions.yaml x: 135 commits (all time) y: 63 lines of code Solutions/AzureSecurityBenchmark/Analytic Rules/AzureSecurityBenchmarkPostureChanged.yaml x: 73 commits (all time) y: 38 lines of code Solutions/Bitwarden/Parsers/BitwardenEventLogs.yaml x: 41 commits (all time) y: 129 lines of code Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/PrivilegedAccountPermissionsChanged.yaml x: 213 commits (all time) y: 79 lines of code Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/SuspiciousAccessOfBECRelatedDocuments.yaml x: 189 commits (all time) y: 88 lines of code Solutions/CiscoWSA/Parsers/CiscoWSAEvent.yaml x: 106 commits (all time) y: 141 lines of code Solutions/Cloud Identity Threat Protection Essentials/Analytic Rules/NewExtUserGrantedAdmin.yaml x: 130 commits (all time) y: 87 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeFalconAdversaryIntelligence/CrowdStrikeFalconThreatIntelConnector/__init__.py x: 39 commits (all time) y: 187 lines of code Solutions/Cybersixgill-Actionable-Alerts/Data Connectors/CybersixgillAlerts/__init__.py x: 121 commits (all time) y: 192 lines of code Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml x: 118 commits (all time) y: 61 lines of code Solutions/FalconFriday/Analytic Rules/DisableOrModifyWindowsDefender.yaml x: 106 commits (all time) y: 5 lines of code Solutions/FalconFriday/Analytic Rules/OfficeProcessInjection.yaml x: 107 commits (all time) y: 24 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/errors.py x: 31 commits (all time) y: 10 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/globalVariables.py x: 65 commits (all time) y: 4 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/sentinel/sentinel.py x: 69 commits (all time) y: 52 lines of code Solutions/GitHub/Analytic Rules/NRT Two Factor Authentication Disabled.yaml x: 58 commits (all time) y: 31 lines of code Solutions/GoogleCloudPlatformIAM/Analytic Rules/GCPIAMDisableDataAccessLogging.yaml x: 113 commits (all time) y: 39 lines of code Solutions/HYAS Protect/Data Connectors/HyasProtect/__init__.py x: 93 commits (all time) y: 184 lines of code Solutions/HolmSecurity/Data Connectors/AzureFunctionHolmSecurityAssetsConn/__init__.py x: 57 commits (all time) y: 103 lines of code Solutions/Legacy IOC based Threat Protection/Hunting Queries/ForestBlizzard_IOC_RetroHunt.yaml x: 124 commits (all time) y: 45 lines of code Solutions/Microsoft 365/Analytic Rules/exchange_auditlogdisabled.yaml x: 214 commits (all time) y: 50 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/AVdetectionsrelatedtoUkrainebasedthreats.yaml x: 79 commits (all time) y: 38 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/PotentialBuildProcessCompromiseMDE.yaml x: 79 commits (all time) y: 71 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Impact/AnomalousVoulmeOfFileDeletion.yaml x: 70 commits (all time) y: 76 lines of code Solutions/Microsoft Entra ID Protection/Analytic Rules/CorrelateIPC_Unfamiliar-Atypical.yaml x: 91 commits (all time) y: 122 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AccountCreatedandDeletedinShortTimeframe.yaml x: 78 commits (all time) y: 105 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AdminPromoAfterRoleMgmtAppPermissionGrant.yaml x: 79 commits (all time) y: 133 lines of code Solutions/Microsoft Entra ID/Analytic Rules/BulkChangestoPrivilegedAccountPermissions.yaml x: 113 commits (all time) y: 88 lines of code Solutions/Microsoft Entra ID/Analytic Rules/Cross-tenantAccessSettingsOrganizationInboundCollaborationSettingsChanged.yaml x: 116 commits (all time) y: 71 lines of code Solutions/Microsoft Entra ID/Analytic Rules/FailedLogonToAzurePortal.yaml x: 120 commits (all time) y: 106 lines of code Solutions/Microsoft Entra ID/Analytic Rules/MFASpammingfollowedbySuccessfullogin.yaml x: 118 commits (all time) y: 46 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SigninPasswordSpray.yaml x: 111 commits (all time) y: 86 lines of code Solutions/Microsoft Entra ID/Analytic Rules/UnusualGuestActivity.yaml x: 150 commits (all time) y: 78 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Parsers/ExchangeEnvironmentList.yaml x: 143 commits (all time) y: 26 lines of code Solutions/Microsoft Exchange Security - Exchange Online/Parsers/ExchangeConfiguration.yaml x: 195 commits (all time) y: 330 lines of code Solutions/Microsoft Exchange Security - Exchange Online/Parsers/ExchangeEnvironmentList.yaml x: 142 commits (all time) y: 26 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml x: 79 commits (all time) y: 104 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/Cross-CloudSuspiciousComputeResourcecreationinGCP.yaml x: 99 commits (all time) y: 179 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/CrossCloudSuspiciousUserActivityObservedInGCPEnvourment.yaml x: 99 commits (all time) y: 151 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray.yaml x: 78 commits (all time) y: 125 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuspiciousAWSConsolLoginByCredentialAceessAlerts.yaml x: 78 commits (all time) y: 130 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/NetskopeToAzureStorage/netskope_to_azure_storage.py x: 29 commits (all time) y: 699 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/StorageToSentinel/netskope_azure_storage_to_sentinel.py x: 29 commits (all time) y: 320 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/StorageToSentinel/remove_duplicates_in_azure_storage.py x: 29 commits (all time) y: 411 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/WebTxMetrics/ingest_message.py x: 30 commits (all time) y: 125 lines of code Solutions/Netskopev2/Parsers/AlertsCtep.yaml x: 29 commits (all time) y: 153 lines of code Solutions/Netskopev2/Parsers/AlertsSecurityAssessment.yaml x: 29 commits (all time) y: 129 lines of code Solutions/Netskopev2/Parsers/AlertsUba.yaml x: 29 commits (all time) y: 326 lines of code Solutions/Network Session Essentials/Analytic Rules/AnomalyFoundInNetworkSessionTraffic.yaml x: 80 commits (all time) y: 192 lines of code Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByAnomalyBasedDetection.yaml x: 113 commits (all time) y: 192 lines of code Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByStaticThreshold.yaml x: 80 commits (all time) y: 151 lines of code Solutions/Network Session Essentials/Analytic Rules/PortScan.yaml x: 97 commits (all time) y: 95 lines of code Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml x: 195 commits (all time) y: 107 lines of code Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByAnomalyHunting.yaml x: 120 commits (all time) y: 173 lines of code Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByStaticThresholdHunting.yaml x: 80 commits (all time) y: 131 lines of code Solutions/Network Session Essentials/Hunting Queries/MismatchBetweenDestinationAppNameAndDestinationPort.yaml x: 80 commits (all time) y: 86 lines of code Solutions/Network Threat Protection Essentials/Analytic Rules/NetworkEndpointCorrelation.yaml x: 109 commits (all time) y: 49 lines of code Solutions/Proofpoint On demand(POD) Email Security/Parsers/ProofpointPOD.yaml x: 97 commits (all time) y: 317 lines of code Solutions/SecurityThreatEssentialSolution/Analytic Rules/Threat_Essentials_TimeSeriesAnomaly-MultiVendor_DataExfiltration.yaml x: 158 commits (all time) y: 121 lines of code Solutions/SecurityThreatEssentialSolution/Analytic Rules/Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml x: 127 commits (all time) y: 59 lines of code Solutions/SenservaPro/Analytic Rules/BlockLegacyAuthentication.yaml x: 142 commits (all time) y: 44 lines of code Solutions/Syslog/Analytic Rules/sftp_file_transfer_above_threshold.yaml x: 123 commits (all time) y: 74 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/models/oat.py x: 97 commits (all time) y: 411 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/models/rca.py x: 33 commits (all time) y: 1 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/services/oat_service.py x: 141 commits (all time) y: 284 lines of code Solutions/Web Session Essentials/Analytic Rules/DataExfiltrationTimeSeriesAnomaly.yaml x: 94 commits (all time) y: 245 lines of code Solutions/Web Session Essentials/Analytic Rules/PossibleMaliciousDoubleExtension.yaml x: 94 commits (all time) y: 88 lines of code Solutions/Web Session Essentials/Analytic Rules/PrivateIPInURL.yaml x: 95 commits (all time) y: 110 lines of code Solutions/Web Session Essentials/Analytic Rules/RarelyRequestedResources.yaml x: 147 commits (all time) y: 101 lines of code Solutions/Web Shells Threat Protection/Analytic Rules/MaliciousAlertLinkedWebRequests.yaml x: 105 commits (all time) y: 85 lines of code Solutions/Web Shells Threat Protection/Analytic Rules/Supernovawebshell.yaml x: 80 commits (all time) y: 63 lines of code Solutions/Windows Security Events/Analytic Rules/ADFSDBNamedPipeConnection.yaml x: 55 commits (all time) y: 77 lines of code Solutions/Windows Security Events/Analytic Rules/ADFSRemoteAuthSyncConnection.yaml x: 108 commits (all time) y: 89 lines of code Solutions/Windows Security Events/Analytic Rules/LocalDeviceJoinInfoAndTransportKeyRegKeysAccess.yaml x: 170 commits (all time) y: 106 lines of code Solutions/Windows Security Events/Analytic Rules/NRT_SecurityEventLogCleared.yaml x: 57 commits (all time) y: 25 lines of code Solutions/Windows Security Events/Analytic Rules/NewEXEdeployedviaDefaultDomainorDefaultDomainControllerPolicies.yaml x: 58 commits (all time) y: 53 lines of code Solutions/Windows Security Events/Analytic Rules/password_not_set.yaml x: 138 commits (all time) y: 74 lines of code Solutions/Zinc Open Source/Analytic Rules/ZincOctober2022_IP_Domain_Hash_IOC.yaml x: 210 commits (all time) y: 195 lines of code Tools/ConvertYamlToJson/ConvertSentinelRuleFrom-Yaml.ps1 x: 155 commits (all time) y: 177 lines of code ASIM/schemas/ASimAuditEvent.yaml x: 156 commits (all time) y: 118 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPAuditLogsSetup/GCPAuditLogsSetup.tf x: 197 commits (all time) y: 78 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPInitialAuthenticationSetup/GCPInitialAuthenticationSetup.tf x: 191 commits (all time) y: 114 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation_gov/GCPInitialAuthenticationSetupGov/GCPInitialAuthenticationSetupGov.tf x: 37 commits (all time) y: 96 lines of code DataConnectors/M365Defender-VulnerabilityManagement/maintenance/buildFiles.ps1 x: 100 commits (all time) y: 2 lines of code DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py x: 269 commits (all time) y: 673 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_Python/Template_REST_API_Function_App_Python.py x: 72 commits (all time) y: 57 lines of code Detections/SecurityEvent/MidnightBlizzard_SuspiciousRundll32Exec.yaml x: 128 commits (all time) y: 84 lines of code Detections/SecurityEvent/password_never_expires.yaml x: 284 commits (all time) y: 107 lines of code Hunting Queries/Microsoft 365 Defender/Defense evasion/regsvr32-rundll32-image-loads-abnormal-extension.yaml x: 38 commits (all time) y: 29 lines of code Hunting Queries/Microsoft 365 Defender/Persistence/Rare-process-as-a-service.yaml x: 38 commits (all time) y: 60 lines of code Hunting Queries/SigninLogs/MFASpamming.yaml x: 39 commits (all time) y: 44 lines of code Hunting Queries/SigninLogs/MFAUserBlocked.yaml x: 224 commits (all time) y: 101 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventVMwareCarbonBlackCloud.yaml x: 79 commits (all time) y: 316 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventEmpty.yaml x: 129 commits (all time) y: 146 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventVMwareCarbonBlackCloud.yaml x: 79 commits (all time) y: 375 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationAADManagedIdentity.yaml x: 213 commits (all time) y: 98 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationAADNonInteractive.yaml x: 238 commits (all time) y: 103 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationAADServicePrincipalSignInLogs.yaml x: 212 commits (all time) y: 133 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationAADSigninLogs.yaml x: 239 commits (all time) y: 111 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationGoogleWorkspace.yaml x: 40 commits (all time) y: 153 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationPaloAltoCortexDataLake.yaml x: 44 commits (all time) y: 172 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationSalesforceSC.yaml x: 58 commits (all time) y: 347 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAADManagedIdentity.yaml x: 208 commits (all time) y: 188 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAADServicePrincipalSignInLogs.yaml x: 207 commits (all time) y: 260 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAADSigninLogs.yaml x: 211 commits (all time) y: 203 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationEmpty.yaml x: 193 commits (all time) y: 153 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationGoogleWorkspace.yaml x: 57 commits (all time) y: 235 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationM365Defender.yaml x: 214 commits (all time) y: 386 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSalesforceSC.yaml x: 68 commits (all time) y: 446 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSu.yaml x: 109 commits (all time) y: 222 lines of code Parsers/ASimDhcpEvent/Parsers/vimDhcpEventEmpty.yaml x: 33 commits (all time) y: 132 lines of code Parsers/ASimDns/Parsers/vimDnsFortinetFortigate.yaml x: 66 commits (all time) y: 273 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventGoogleWorkspace.yaml x: 44 commits (all time) y: 285 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventEmpty.yaml x: 180 commits (all time) y: 161 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventGoogleWorkspace.yaml x: 46 commits (all time) y: 343 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionPaloAltoCEF.yaml x: 210 commits (all time) y: 131 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionSonicWallFirewall.yaml x: 42 commits (all time) y: 385 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAWSVPC.yaml x: 159 commits (all time) y: 292 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAzureFirewall.yaml x: 130 commits (all time) y: 190 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionPaloAltoCEF.yaml x: 236 commits (all time) y: 180 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSonicWallFirewall.yaml x: 42 commits (all time) y: 435 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionVMConnection.yaml x: 201 commits (all time) y: 260 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionWatchGuardFirewareOS.yaml x: 89 commits (all time) y: 207 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessEventTerminate.yaml x: 156 commits (all time) y: 41 lines of code Parsers/ASimProcessEvent/Parsers/imProcessTerminate.yaml x: 214 commits (all time) y: 79 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventEmpty.yaml x: 116 commits (all time) y: 117 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementCiscoISE.yaml x: 95 commits (all time) y: 130 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementLinuxAuthpriv.yaml x: 89 commits (all time) y: 318 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementSentinelOne.yaml x: 95 commits (all time) y: 178 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementCiscoISE.yaml x: 110 commits (all time) y: 173 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementEmpty.yaml x: 150 commits (all time) y: 146 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementLinuxAuthpriv.yaml x: 90 commits (all time) y: 411 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementSentinelOne.yaml x: 93 commits (all time) y: 221 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_ChangeToRDSDatabase.yaml x: 136 commits (all time) y: 51 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_GuardDuty_template.yaml x: 210 commits (all time) y: 151 lines of code Solutions/Amazon Web Services/Hunting Queries/AWS_IAM_PrivilegeEscalationbyAttachment.yaml x: 57 commits (all time) y: 52 lines of code Solutions/Armis/Data Connectors/ArmisActivities/ArmisActivitySentinelConnector/__init__.py x: 131 commits (all time) y: 367 lines of code Solutions/Azure Activity/Analytic Rules/Creating_Anomalous_Number_Of_Resources_detection.yaml x: 144 commits (all time) y: 64 lines of code Solutions/Azure Activity/Analytic Rules/Creation_of_Expensive_Computes_in_Azure.yaml x: 169 commits (all time) y: 53 lines of code Solutions/Azure Activity/Analytic Rules/Granting_Permissions_To_Account_detection.yaml x: 113 commits (all time) y: 65 lines of code Solutions/Azure Activity/Analytic Rules/NewResourceGroupsDeployedTo.yaml x: 153 commits (all time) y: 38 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/SharedCode/azure_sentinel.py x: 88 commits (all time) y: 85 lines of code Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/AccountElevatedtoNewRole.yaml x: 163 commits (all time) y: 87 lines of code Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/AuthenticationMethodChangedforPrivilegedAccount.yaml x: 187 commits (all time) y: 71 lines of code Solutions/Business Email Compromise - Financial Fraud/Hunting Queries/SuccessfulSigninFromNon-CompliantDevice.yaml x: 166 commits (all time) y: 67 lines of code Solutions/Business Email Compromise - Financial Fraud/Hunting Queries/UserLoginIPAddressTeleportation.yaml x: 166 commits (all time) y: 112 lines of code Solutions/Business Email Compromise - Financial Fraud/Hunting Queries/riskSignInWithNewMFAMethod.yaml x: 166 commits (all time) y: 94 lines of code Solutions/CiscoUmbrella/Data Connectors/ciscoUmbrellaDataConn/__init__.py x: 165 commits (all time) y: 543 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/SuspiciousSignintoPrivilegedAccount.yaml x: 240 commits (all time) y: 92 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/SecurityEventLogCleared.yaml x: 115 commits (all time) y: 59 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/SuspiciousPowerShellCommandExecuted.yaml x: 64 commits (all time) y: 69 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/base64_encoded_pefile.yaml x: 111 commits (all time) y: 68 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/execute_base64_decodedpayload.yaml x: 103 commits (all time) y: 73 lines of code Solutions/Endpoint Threat Protection Essentials/Hunting Queries/PersistViaIFEORegistryKey.yaml x: 109 commits (all time) y: 90 lines of code Solutions/Endpoint Threat Protection Essentials/Hunting Queries/WindowsFirewallUpdateUsingNetsh.yaml x: 38 commits (all time) y: 147 lines of code Solutions/GitHub/Analytic Rules/(Preview) GitHub - A payment method was removed.yaml x: 72 commits (all time) y: 30 lines of code Solutions/GoogleWorkspaceReports/Data Connectors/GWorkspaceReportsAPISentinelConn/GWorkspaceReports-QueueTrigger/__init__.py x: 61 commits (all time) y: 273 lines of code Solutions/GoogleWorkspaceReports/Data Connectors/GWorkspaceReportsAPISentinelConn/GWorkspaceReports-QueueTrigger/state_manager.py x: 37 commits (all time) y: 99 lines of code Solutions/GoogleWorkspaceReports/Data Connectors/GWorkspaceReportsAPISentinelConn/GWorkspaceReports-TimeTrigger/__init__.py x: 37 commits (all time) y: 207 lines of code Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml x: 110 commits (all time) y: 64 lines of code Solutions/Microsoft 365/Analytic Rules/Office_MailForwarding.yaml x: 162 commits (all time) y: 59 lines of code Solutions/Microsoft 365/Analytic Rules/RareOfficeOperations.yaml x: 185 commits (all time) y: 45 lines of code Solutions/Microsoft 365/Analytic Rules/office_policytampering.yaml x: 165 commits (all time) y: 62 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Campaign/Macaw Ransomware/ImminentRansomware.yaml x: 25 commits (all time) y: 63 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Credential Access/DoppelPaymerProcDump.yaml x: 24 commits (all time) y: 52 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Lateral Movement/ServiceAccountsPerformingRemotePS.yaml x: 22 commits (all time) y: 72 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Campaigns/JudgementPandaExfilActivity.yaml x: 43 commits (all time) y: 28 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Command and Control/C2-NamedPipe.yaml x: 43 commits (all time) y: 65 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Ransomware/DetectMultipleSignsOfRamsomwareActivity.yaml x: 43 commits (all time) y: 90 lines of code Solutions/Microsoft Entra ID/Analytic Rules/NRT_NewAppOrServicePrincipalCredential.yaml x: 147 commits (all time) y: 84 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SuspiciousAADJoinedDeviceUpdate.yaml x: 135 commits (all time) y: 102 lines of code Solutions/Microsoft Entra ID/Analytic Rules/UserAccounts-CABlockedSigninSpikes.yaml x: 136 commits (all time) y: 114 lines of code Solutions/Network Session Essentials/Analytic Rules/Remote Desktop Network Brute force (ASIM Network Session schema).yaml x: 31 commits (all time) y: 39 lines of code Solutions/Network Session Essentials/Hunting Queries/Protocols passing authentication in cleartext (ASIM Network Session schema).yaml x: 35 commits (all time) y: 35 lines of code Solutions/Network Threat Protection Essentials/Hunting Queries/B64IPInURL.yaml x: 106 commits (all time) y: 73 lines of code Solutions/Sophos Endpoint Protection/Parsers/SophosEPEvent.yaml x: 113 commits (all time) y: 71 lines of code Solutions/Syslog/Hunting Queries/RareProcess_ForLxHost.yaml x: 80 commits (all time) y: 40 lines of code Solutions/Syslog/Hunting Queries/SchedTaskAggregation.yaml x: 76 commits (all time) y: 9 lines of code Solutions/VMware Carbon Black Cloud/Data Connectors/AzureFunctionVMwareCarbonBlack/AlertsApiTimer/run.ps1 x: 47 commits (all time) y: 307 lines of code Solutions/VMware Carbon Black Cloud/Data Connectors/AzureFunctionVMwareCarbonBlack/AuditEventsAlertsTimer/run.ps1 x: 47 commits (all time) y: 375 lines of code Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sase-cwsdlp-violation.yaml x: 35 commits (all time) y: 51 lines of code Solutions/VMware SD-WAN and SASE/Hunting Queries/VECOfrequentFailedLogins.yaml x: 32 commits (all time) y: 27 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/DatAlert/DatAlertClientFake.cs x: 36 commits (all time) y: 57 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/DatAlert/IDatAlertClient.cs x: 36 commits (all time) y: 10 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Helpers/AlertExtensions.cs x: 36 commits (all time) y: 24 lines of code Solutions/Veritas NetBackup/Analytic Rules/NetBackup_many_login_fail.yaml x: 57 commits (all time) y: 38 lines of code Solutions/Windows Security Events/Analytic Rules/NonDCActiveDirectoryReplication.yaml x: 129 commits (all time) y: 70 lines of code Solutions/Windows Security Events/Hunting Queries/HostExportingMailboxAndRemovingExport.yaml x: 106 commits (all time) y: 57 lines of code Solutions/Windows Security Events/Hunting Queries/HostsWithNewLogons.yaml x: 105 commits (all time) y: 66 lines of code Solutions/Windows Security Events/Hunting Queries/ProcessEntropy.yaml x: 104 commits (all time) y: 150 lines of code Solutions/Windows Security Events/Hunting Queries/Suspicious_Windows_Login_outside_normal_hours.yaml x: 105 commits (all time) y: 123 lines of code Solutions/Windows Security Events/Hunting Queries/uncommon_processes.yaml x: 101 commits (all time) y: 57 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/events_formatter.py x: 38 commits (all time) y: 113 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/ws_connector.py x: 39 commits (all time) y: 25 lines of code Tools/PowerShell/SentinelAnalyticRulesManagementScript.ps1 x: 22 commits (all time) y: 1107 lines of code Parsers/ASimRegistryEvent/Parsers/VimRegistryEventMicrosoftSecurityEvent.yaml x: 5 commits (all time) y: 172 lines of code ASIM/dev/ASimTester/filteringTest/ASimFilteringTest.py x: 110 commits (all time) y: 484 lines of code ASIM/lib/functions/ASIM_GetUserType.yaml x: 47 commits (all time) y: 45 lines of code ASIM/schemas/ASimAuthentication.yaml x: 162 commits (all time) y: 106 lines of code ASIM/schemas/ASimDHCPEvent.yaml x: 73 commits (all time) y: 110 lines of code ASIM/schemas/ASimDns.yaml x: 163 commits (all time) y: 256 lines of code ASIM/schemas/ASimFileEvent.yaml x: 214 commits (all time) y: 232 lines of code ASIM/schemas/ASimUserManagement.yaml x: 91 commits (all time) y: 95 lines of code ASIM/schemas/common/ASimEventFields.yaml x: 104 commits (all time) y: 120 lines of code ASIM/schemas/entities/ASimDvc.yaml x: 104 commits (all time) y: 91 lines of code ASIM/schemas/entities/ASimExtendedProcess.yaml x: 137 commits (all time) y: 10 lines of code ASIM/schemas/entities/ASimProcess.yaml x: 134 commits (all time) y: 10 lines of code ASIM/schemas/entities/ASimSystem.yaml x: 149 commits (all time) y: 107 lines of code DataConnectors/CEF/cef_installer.py x: 212 commits (all time) y: 554 lines of code DataConnectors/CEF/cef_troubleshoot.py x: 268 commits (all time) y: 653 lines of code DataConnectors/DocuSign-SecurityEvents/AzureFunctionDocuSignMonitor/DocuSignMonitorTimerTrigger/run.ps1 x: 87 commits (all time) y: 381 lines of code DataConnectors/M365Defender-VulnerabilityManagement/deploymentScript.ps1 x: 72 commits (all time) y: 22 lines of code DataConnectors/M365Defender-VulnerabilityManagement/functionPackage/profile.ps1 x: 62 commits (all time) y: 19 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_C#/Template_REST_API_Function_App_C#.cs x: 41 commits (all time) y: 237 lines of code DataConnectors/Zoom/ZoomLogs/run.ps1 x: 70 commits (all time) y: 165 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/customSizeBasedBuffer.rb x: 50 commits (all time) y: 137 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/eventsHandler.rb x: 50 commits (all time) y: 43 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashAutoResizeBuffer.rb x: 50 commits (all time) y: 104 lines of code Detections/ASimAuthentication/imSigninAttemptsByIPviaDisabledAccounts.yaml x: 147 commits (all time) y: 54 lines of code Detections/ASimDNS/imDNS_Miners.yaml x: 259 commits (all time) y: 89 lines of code Detections/ASimDNS/imDNS_TorProxies.yaml x: 233 commits (all time) y: 77 lines of code Detections/ASimDNS/imDns_DomainEntity_DnsEvents.yaml x: 132 commits (all time) y: 4 lines of code Detections/ASimDNS/imDns_ExcessiveNXDOMAINDNSQueries.yaml x: 212 commits (all time) y: 70 lines of code Detections/ASimDNS/imDns_IPEntity_DnsEvents.yaml x: 193 commits (all time) y: 4 lines of code Detections/ASimFileEvent/SuspiciousAccessOfBECRelatedDocuments.yaml x: 95 commits (all time) y: 5 lines of code Detections/ASimNetworkSession/ExcessiveHTTPFailuresFromSource.yaml x: 131 commits (all time) y: 4 lines of code Detections/ASimNetworkSession/IPEntity_imNetworkSession.yaml x: 120 commits (all time) y: 4 lines of code Detections/ASimNetworkSession/PossibleBeaconingActivity.yaml x: 116 commits (all time) y: 4 lines of code Detections/ASimProcess/Potentialre-namedsdeleteusage(ASIMVersion).yaml x: 176 commits (all time) y: 24 lines of code Detections/ASimWebSession/DiscordCDNRiskyFileDownload_ASim.yaml x: 131 commits (all time) y: 63 lines of code Detections/ASimWebSession/PotentiallyHarmfulFileTypes.yaml x: 207 commits (all time) y: 85 lines of code Detections/AWSCloudTrail/AWS_ChangeToRDSDatabase.yaml x: 195 commits (all time) y: 5 lines of code Detections/AWSCloudTrail/AWS_ChangeToVPC.yaml x: 225 commits (all time) y: 5 lines of code Detections/AWSCloudTrail/AWS_CredentialHijack.yaml x: 176 commits (all time) y: 5 lines of code Detections/AWSCloudTrail/AWS_IngressEgressSecurityGroupChange.yaml x: 171 commits (all time) y: 5 lines of code Detections/AWSCloudTrail/SuspiciousAccessOfBECRelatedDocumentsInAWSS3Buckets.yaml x: 119 commits (all time) y: 5 lines of code Detections/AWSGuardDuty/AWS_GuardDuty_template.yaml x: 151 commits (all time) y: 4 lines of code Detections/AuditLogs/ADFSDomainTrustMods.yaml x: 283 commits (all time) y: 5 lines of code Detections/AuditLogs/AccountCreatedandDeletedinShortTimeframe.yaml x: 209 commits (all time) y: 5 lines of code Detections/AuditLogs/AccountElevatedtoNewRole.yaml x: 124 commits (all time) y: 5 lines of code Detections/AuditLogs/AdminPromoAfterRoleMgmtAppPermissionGrant.yaml x: 243 commits (all time) y: 5 lines of code Detections/AuditLogs/ApplicationRedirectURLUpdate.yaml x: 169 commits (all time) y: 86 lines of code Detections/AuditLogs/AzureADRoleManagementPermissionGrant.yaml x: 242 commits (all time) y: 5 lines of code Detections/AuditLogs/BulkChangestoPrivilegedAccountPermissions.yaml x: 203 commits (all time) y: 5 lines of code Detections/AuditLogs/ChangestoApplicationLogoutURL.yaml x: 168 commits (all time) y: 77 lines of code Detections/AuditLogs/ChangestoApplicationOwnership.yaml x: 191 commits (all time) y: 78 lines of code Detections/AuditLogs/ConditionalAccessPolicyModifiedbyNewUser.yaml x: 208 commits (all time) y: 79 lines of code Detections/AuditLogs/CredentialAddedAfterAdminConsent.yaml x: 249 commits (all time) y: 5 lines of code Detections/AuditLogs/Cross-tenantAccessSettingsOrganizationAdded.yaml x: 123 commits (all time) y: 6 lines of code Detections/AuditLogs/FirstAppOrServicePrincipalCredential.yaml x: 304 commits (all time) y: 5 lines of code Detections/AuditLogs/GuestAccountsAddedinAADGroupsOtherThanTheOnesSpecified.yaml x: 175 commits (all time) y: 6 lines of code Detections/AuditLogs/GuestUsersInvitedtoTenantbyNewInviters.yaml x: 168 commits (all time) y: 84 lines of code Detections/AuditLogs/MaliciousOAuthApp_O365AttackToolkit.yaml x: 237 commits (all time) y: 5 lines of code Detections/AuditLogs/MaliciousOAuthApp_PwnAuth.yaml x: 239 commits (all time) y: 5 lines of code Detections/AuditLogs/MultipleAdmin_membership_removals_from_NewAdmin.yaml x: 162 commits (all time) y: 5 lines of code Detections/AuditLogs/NRT_ADFSDomainTrustMods.yaml x: 177 commits (all time) y: 5 lines of code Detections/AuditLogs/NRT_AuthenticationMethodsChangedforVIPUsers.yaml x: 127 commits (all time) y: 6 lines of code Detections/AuditLogs/NRT_UseraddedtoPrivilgedGroups.yaml x: 184 commits (all time) y: 5 lines of code Detections/AuditLogs/NewAppOrServicePrincipalCredential.yaml x: 299 commits (all time) y: 5 lines of code Detections/AuditLogs/NewExtUserGrantedAdmin.yaml x: 109 commits (all time) y: 5 lines of code Detections/AuditLogs/PrivilegedAccountPermissionsChanged.yaml x: 125 commits (all time) y: 5 lines of code Detections/AuditLogs/PrivlegedRoleAssignedOutsidePIM.yaml x: 219 commits (all time) y: 5 lines of code Detections/AuditLogs/RareApplicationConsent.yaml x: 288 commits (all time) y: 5 lines of code Detections/AuditLogs/SuspiciousLinkingofExternalIdtoExistingUsers.yaml x: 173 commits (all time) y: 82 lines of code Detections/AuditLogs/SuspiciousOAuthApp_OfflineAccess.yaml x: 233 commits (all time) y: 5 lines of code Detections/AuditLogs/URLAddedtoApplicationfromUnknownDomain.yaml x: 225 commits (all time) y: 101 lines of code Detections/AuditLogs/UserAccountCreatedUsingIncorrectNamingFormat.yaml x: 112 commits (all time) y: 82 lines of code Detections/AuditLogs/UserAddedtoAdminRole.yaml x: 158 commits (all time) y: 5 lines of code Detections/AuditLogs/Useraccountcreatedwithoutexpectedattributesdefined.yaml x: 164 commits (all time) y: 95 lines of code Detections/AuditLogs/UseraddedtoPrivilgedGroups.yaml x: 316 commits (all time) y: 5 lines of code Detections/AzureActivity/AADHybridHealthADFSNewServer.yaml x: 166 commits (all time) y: 4 lines of code Detections/AzureActivity/AADHybridHealthADFSServiceDelete.yaml x: 168 commits (all time) y: 4 lines of code Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml x: 258 commits (all time) y: 4 lines of code Detections/AzureActivity/NRT-AADHybridHealthADFSNewServer.yaml x: 156 commits (all time) y: 4 lines of code Detections/AzureActivity/NewResourceGroupsDeployedTo.yaml x: 189 commits (all time) y: 4 lines of code Detections/AzureActivity/TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml x: 86 commits (all time) y: 4 lines of code Detections/AzureDiagnostics/KeyvaultMassSecretRetrieval.yaml x: 276 commits (all time) y: 5 lines of code Detections/AzureDiagnostics/MaliciousWAFSessions.yaml x: 216 commits (all time) y: 5 lines of code Detections/AzureDiagnostics/NRT_KeyVaultSensitiveOperations.yaml x: 110 commits (all time) y: 5 lines of code Detections/AzureDiagnostics/TimeSeriesKeyvaultAccessAnomaly.yaml x: 238 commits (all time) y: 5 lines of code Detections/AzureFirewall/SeveralDenyActionsRegistered.yaml x: 256 commits (all time) y: 5 lines of code Detections/AzureWAF/AFD-Premium-WAF-SQLiDetection.yaml x: 68 commits (all time) y: 4 lines of code Detections/AzureWAF/AFD-Premium-WAF-XSSDetection.yaml x: 69 commits (all time) y: 4 lines of code Detections/CiscoUmbrella/CiscoUmbrellaConnectionToUnpopularWebsiteDetected.yaml x: 167 commits (all time) y: 43 lines of code Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml x: 167 commits (all time) y: 34 lines of code Detections/CiscoUmbrella/CiscoUmbrellaURIContainsIPAddress.yaml x: 150 commits (all time) y: 34 lines of code Detections/CommonSecurityLog/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 135 commits (all time) y: 5 lines of code Detections/CommonSecurityLog/CiscoASA-ThreatDetectionMessage.yaml x: 149 commits (all time) y: 5 lines of code Detections/CommonSecurityLog/PaloAlto-NetworkBeaconing.yaml x: 160 commits (all time) y: 5 lines of code Detections/DeviceEvents/SolarWinds_TEARDROP_Process-IOCs.yaml x: 341 commits (all time) y: 5 lines of code Detections/DeviceFileEvents/SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs.yaml x: 307 commits (all time) y: 5 lines of code Detections/DeviceNetworkEvents/SolarWinds_SUNBURST_Network-IOCs.yaml x: 310 commits (all time) y: 5 lines of code Detections/DeviceProcessEvents/SolarWinds_SUNBURST_Process-IOCs.yaml x: 273 commits (all time) y: 61 lines of code Detections/DnsEvents/DNS_HighNXDomainCount_detection.yaml x: 185 commits (all time) y: 5 lines of code Detections/GitHub/(Preview) GitHub - Activities from Infrequent Country.yaml x: 54 commits (all time) y: 5 lines of code Detections/GitHub/Security Vulnerability in Repo.yaml x: 147 commits (all time) y: 6 lines of code Detections/GitHub/Threat Intel Matches to GitHub Audit Logs.yaml x: 164 commits (all time) y: 4 lines of code Detections/MultipleDataSources/ADFS-DKM-MasterKey-Export.yaml x: 274 commits (all time) y: 98 lines of code Detections/MultipleDataSources/AWSConsoleAADCorrelation.yaml x: 323 commits (all time) y: 69 lines of code Detections/MultipleDataSources/AuthenticationMethodsChangedforPrivilegedAccount.yaml x: 280 commits (all time) y: 5 lines of code Detections/MultipleDataSources/BariumIPIOC112020.yaml x: 329 commits (all time) y: 5 lines of code Detections/MultipleDataSources/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml x: 114 commits (all time) y: 3 lines of code Detections/MultipleDataSources/CrossCloudUnauthorizedCredentialsAccessDetection.yaml x: 143 commits (all time) y: 3 lines of code Detections/MultipleDataSources/Dev-0228FilePathHashesNovember2021.yaml x: 217 commits (all time) y: 77 lines of code Detections/MultipleDataSources/Dev-0270NewUserSep2022.yaml x: 82 commits (all time) y: 4 lines of code Detections/MultipleDataSources/Dev-0270PowershellSep2022.yaml x: 113 commits (all time) y: 5 lines of code Detections/MultipleDataSources/Dev-0270RegistryIOCSep2022.yaml x: 112 commits (all time) y: 5 lines of code Detections/MultipleDataSources/EUROPIUM _September2022.yaml x: 187 commits (all time) y: 159 lines of code Detections/MultipleDataSources/ExchangeServerVulnerabilitiesMarch2021IoCs.yaml x: 311 commits (all time) y: 5 lines of code Detections/MultipleDataSources/ForestBlizzardJuly2019IOCs.yaml x: 134 commits (all time) y: 142 lines of code Detections/MultipleDataSources/GainCodeExecutionADFSviaWMI.yaml x: 180 commits (all time) y: 171 lines of code Detections/MultipleDataSources/HostAADCorrelation.yaml x: 306 commits (all time) y: 102 lines of code Detections/MultipleDataSources/MFADisable.yaml x: 263 commits (all time) y: 5 lines of code Detections/MultipleDataSources/Mercury_Log4j_August2022.yaml x: 175 commits (all time) y: 244 lines of code Detections/MultipleDataSources/PHOSPHORUSMarch2019IOCs.yaml x: 297 commits (all time) y: 5 lines of code Detections/MultipleDataSources/PotentialBuildProcessCompromiseMDE.yaml x: 241 commits (all time) y: 5 lines of code Detections/MultipleDataSources/PotentialMercury_Webshell.yaml x: 117 commits (all time) y: 6 lines of code Detections/MultipleDataSources/SUNSPOTLogFile.yaml x: 223 commits (all time) y: 5 lines of code Detections/MultipleDataSources/Solorigate-Network-Beacon.yaml x: 286 commits (all time) y: 5 lines of code Detections/MultipleDataSources/Solorigate-VM-Network.yaml x: 187 commits (all time) y: 5 lines of code Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml x: 240 commits (all time) y: 138 lines of code Detections/MultipleDataSources/WSLMalwareCorrelation.yaml x: 247 commits (all time) y: 5 lines of code Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml x: 246 commits (all time) y: 5 lines of code Detections/OfficeActivity/MailItemsAccessedTimeSeries.yaml x: 191 commits (all time) y: 5 lines of code Detections/OfficeActivity/Office_MailForwarding.yaml x: 252 commits (all time) y: 5 lines of code Detections/OfficeActivity/RareOfficeOperations.yaml x: 265 commits (all time) y: 5 lines of code Detections/OfficeActivity/exchange_auditlogdisabled.yaml x: 179 commits (all time) y: 5 lines of code Detections/OfficeActivity/office_policytampering.yaml x: 207 commits (all time) y: 5 lines of code Detections/ProofpointPOD/ProofpointPODEmailSenderInTIList.yaml x: 205 commits (all time) y: 6 lines of code Detections/ProofpointPOD/ProofpointPODHighRiskNotDiscarded.yaml x: 190 commits (all time) y: 4 lines of code Detections/QualysVMV2/HighNumberofVulnDetectedV2.yaml x: 146 commits (all time) y: 5 lines of code Detections/QualysVMV2/NewHighSeverityVulnDetectedAcrossMulitpleHostsV2.yaml x: 145 commits (all time) y: 5 lines of code Detections/SecurityAlert/Massdownload_USBFileCopy.yaml x: 149 commits (all time) y: 131 lines of code Detections/SecurityAlert/Solorigate-Defender-Detections.yaml x: 232 commits (all time) y: 60 lines of code Detections/SecurityEvent/AADHealthMonAgentRegKeyAccess.yaml x: 236 commits (all time) y: 139 lines of code Detections/SecurityEvent/AADHealthSvcAgentRegKeyAccess.yaml x: 196 commits (all time) y: 137 lines of code Detections/SecurityEvent/ADFSAbnormalEnhancedKeyUsageAttribute-OID.yaml x: 124 commits (all time) y: 72 lines of code Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml x: 129 commits (all time) y: 5 lines of code Detections/SecurityEvent/ADFSRemoteAuthSyncConnection.yaml x: 138 commits (all time) y: 5 lines of code Detections/SecurityEvent/ADFSRemoteHTTPNetworkConnection.yaml x: 107 commits (all time) y: 5 lines of code Detections/SecurityEvent/COMEventSystemLoadingNewDLL.yaml x: 128 commits (all time) y: 117 lines of code Detections/SecurityEvent/CredentialDumpingToolsFileArtifacts.yaml x: 128 commits (all time) y: 5 lines of code Detections/SecurityEvent/DumpingLSASSProcessIntoaFile.yaml x: 84 commits (all time) y: 5 lines of code Detections/SecurityEvent/FakeComputerAccountCreated.yaml x: 108 commits (all time) y: 71 lines of code Detections/SecurityEvent/LateralMovementViaDCOM.yaml x: 80 commits (all time) y: 5 lines of code Detections/SecurityEvent/PotentialBuildProcessCompromise.yaml x: 213 commits (all time) y: 121 lines of code Detections/SecurityEvent/RDP_MultipleConnectionsFromSingleSystem.yaml x: 268 commits (all time) y: 96 lines of code Detections/SecurityEvent/SilkTyphoonNewUMServiceChildProcess.yaml x: 98 commits (all time) y: 95 lines of code Detections/SecurityEvent/SolorigateNamedPipe.yaml x: 256 commits (all time) y: 95 lines of code Detections/SecurityEvent/UserCreatedAddedToBuiltinAdmins_1d.yaml x: 236 commits (all time) y: 141 lines of code Detections/SecurityEvent/gte_6_FailedLogons_10m.yaml x: 361 commits (all time) y: 140 lines of code Detections/SecurityEvent/powershell_empire.yaml x: 268 commits (all time) y: 5 lines of code Detections/SigninLogs/ADFSSignInLogsPasswordSpray.yaml x: 169 commits (all time) y: 5 lines of code Detections/SigninLogs/AnomalousUserAppSigninLocationIncrease-detection.yaml x: 232 commits (all time) y: 5 lines of code Detections/SigninLogs/AzureAADPowerShellAnomaly.yaml x: 281 commits (all time) y: 5 lines of code Detections/SigninLogs/AzurePortalSigninfromanotherAzureTenant.yaml x: 266 commits (all time) y: 5 lines of code Detections/SigninLogs/DistribPassCrackAttempt.yaml x: 261 commits (all time) y: 5 lines of code Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml x: 261 commits (all time) y: 66 lines of code Detections/SigninLogs/Sign-in Burst from Multiple Locations.yaml x: 221 commits (all time) y: 5 lines of code Detections/SigninLogs/UserAccounts-CABlockedSigninSpikes.yaml x: 197 commits (all time) y: 5 lines of code Detections/Syslog/squid_cryptomining_pools.yaml x: 183 commits (all time) y: 5 lines of code Detections/Syslog/ssh_potentialBruteForce.yaml x: 211 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/DomainEntity_PaloAlto.yaml x: 228 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/DomainEntity_Syslog.yaml x: 217 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/EmailEntity_AzureActivity.yaml x: 231 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/EmailEntity_SecurityEvent.yaml x: 253 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/FileHashEntity_SecurityEvent.yaml x: 278 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/IPEntity_AWSCloudTrail.yaml x: 210 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/URLEntity_OfficeActivity.yaml x: 254 commits (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/URLEntity_SecurityAlerts.yaml x: 213 commits (all time) y: 5 lines of code Detections/W3CIISLog/AnomomlousUserAgentConnection.yaml x: 182 commits (all time) y: 63 lines of code Detections/W3CIISLog/HighFailedLogonCountByUser.yaml x: 190 commits (all time) y: 99 lines of code Exploration Queries/InputEntity_Account/UserAccount_NewInteractiveLogon.yaml x: 82 commits (all time) y: 44 lines of code Exploration Queries/InputEntity_Account/UserAccount_ResourceLogon.yaml x: 63 commits (all time) y: 61 lines of code Exploration Queries/InputEntity_Host/MostPrevIn_ByHost.yaml x: 42 commits (all time) y: 29 lines of code Exploration Queries/InputEntity_Host/UsersConnectedByHost.yaml x: 57 commits (all time) y: 57 lines of code Hunting Queries/ASimProcess/imProcess_ProcessEntropy.yaml x: 121 commits (all time) y: 146 lines of code Hunting Queries/ASimProcess/imProcess_SolarWindsInventory.yaml x: 120 commits (all time) y: 19 lines of code Hunting Queries/ASimProcess/imProcess_powershell_downloads.yaml x: 170 commits (all time) y: 18 lines of code Hunting Queries/AzureStorage/AzureStorageFileOnEndpoint.yaml x: 129 commits (all time) y: 24 lines of code Hunting Queries/Microsoft 365 Defender/Campaigns/redmenshen-bpfdoor-backdoor.yaml x: 84 commits (all time) y: 21 lines of code Hunting Queries/Microsoft 365 Defender/General queries/Endpoint Agent Health Status Report.yaml x: 121 commits (all time) y: 106 lines of code Hunting Queries/Microsoft 365 Defender/Initial access/SuspiciousUrlClicked.yaml x: 194 commits (all time) y: 18 lines of code Hunting Queries/Microsoft 365 Defender/Persistence/LocalAdminGroupChanges.yaml x: 104 commits (all time) y: 46 lines of code Hunting Queries/Microsoft 365 Defender/Persistence/multipleAADAdminsRemovals.yaml x: 77 commits (all time) y: 29 lines of code Hunting Queries/Microsoft 365 Defender/Privilege escalation/Add uncommon credential type to application [Nobelium].yaml x: 101 commits (all time) y: 5 lines of code Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_Action1_filesig.yaml x: 61 commits (all time) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_Level_createproc.yaml x: 65 commits (all time) y: 21 lines of code Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_ServerEye_netconn.yaml x: 64 commits (all time) y: 26 lines of code Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm__all_netconn.yaml x: 62 commits (all time) y: 185 lines of code Hunting Queries/MultipleDataSources/CriticalOperationsWithSystemrestore.yaml x: 116 commits (all time) y: 103 lines of code Hunting Queries/MultipleDataSources/FirewallRuleChanges_using_netsh.yaml x: 119 commits (all time) y: 145 lines of code Hunting Queries/MultipleDataSources/MailForwardingActivityFromNewLocation.yaml x: 92 commits (all time) y: 75 lines of code Hunting Queries/MultipleDataSources/PermutationsOnLogonNames.yaml x: 127 commits (all time) y: 124 lines of code Hunting Queries/MultipleDataSources/PrivilegedAccountsLockedOut.yaml x: 132 commits (all time) y: 36 lines of code Hunting Queries/MultipleDataSources/RareDNSLookupWithDataTransfer.yaml x: 180 commits (all time) y: 113 lines of code Hunting Queries/MultipleDataSources/RareDomainsInCloudLogs.yaml x: 153 commits (all time) y: 107 lines of code Hunting Queries/MultipleDataSources/TrackingPasswordChanges.yaml x: 135 commits (all time) y: 87 lines of code Hunting Queries/MultipleDataSources/TrackingPrivAccounts.yaml x: 162 commits (all time) y: 187 lines of code Hunting Queries/OfficeActivity/MultipleUsersEmailForwardedToSameDestination.yaml x: 42 commits (all time) y: 4 lines of code Hunting Queries/SigninLogs/LoginSpikeWithIncreaseFailureRate.yaml x: 134 commits (all time) y: 75 lines of code Hunting Queries/SigninLogs/signinBurstFromMultipleLocations.yaml x: 155 commits (all time) y: 70 lines of code Hunting Queries/W3CIISLog/ClientIPwithManyUserAgents.yaml x: 159 commits (all time) y: 38 lines of code Hunting Queries/W3CIISLog/PotentialWebshell.yaml x: 157 commits (all time) y: 5 lines of code Hunting Queries/W3CIISLog/Potential_IIS_BF.yaml x: 141 commits (all time) y: 83 lines of code Hunting Queries/W3CIISLog/Potential_IIS_CodeInject.yaml x: 180 commits (all time) y: 94 lines of code Hunting Queries/W3CIISLog/RareClientFileAccess.yaml x: 228 commits (all time) y: 52 lines of code Hunting Queries/W3CIISLog/SuspectedMailBoxExportHostonOWA.yaml x: 184 commits (all time) y: 26 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCiscoISE.yaml x: 57 commits (all time) y: 295 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCrowdStrikeFalconHost.yaml x: 37 commits (all time) y: 160 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventVectraXDRAudit.yaml x: 151 commits (all time) y: 54 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventCiscoISE.yaml x: 59 commits (all time) y: 360 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventCrowdStrikeFalconHost.yaml x: 37 commits (all time) y: 217 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoASA.yaml x: 58 commits (all time) y: 226 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoISE.yaml x: 113 commits (all time) y: 257 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconHost.yaml x: 44 commits (all time) y: 109 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationM365Defender.yaml x: 192 commits (all time) y: 186 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationSshd.yaml x: 133 commits (all time) y: 210 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationSudo.yaml x: 117 commits (all time) y: 119 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationVectraXDRAudit.yaml x: 60 commits (all time) y: 54 lines of code Parsers/ASimDns/Parsers/ASimDnsFortinetFortigate.yaml x: 43 commits (all time) y: 214 lines of code Parsers/ASimDns/Parsers/ASimDnsMicrosoftNXlog.yaml x: 121 commits (all time) y: 280 lines of code Parsers/ASimDns/Parsers/ASimDnsSentinelOne.yaml x: 60 commits (all time) y: 196 lines of code Parsers/ASimDns/Parsers/vimDnsInfobloxNIOS.yaml x: 210 commits (all time) y: 209 lines of code Parsers/ASimDns/Parsers/vimDnsMicrosoftNXlog.yaml x: 106 commits (all time) y: 335 lines of code Parsers/ASimDns/Parsers/vimDnsSentinelOne.yaml x: 60 commits (all time) y: 248 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventAzureBlobStorage.yaml x: 58 commits (all time) y: 85 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventAzureFileStorage.yaml x: 58 commits (all time) y: 69 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventLinuxSysmonFileCreated.yaml x: 57 commits (all time) y: 72 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventLinuxSysmonFileDeleted.yaml x: 57 commits (all time) y: 94 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftSharePoint.yaml x: 57 commits (all time) y: 147 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventNative.yaml x: 74 commits (all time) y: 53 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventSentinelOne.yaml x: 106 commits (all time) y: 125 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventVMwareCarbonBlackCloud.yaml x: 64 commits (all time) y: 154 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventAzureBlobStorage.yaml x: 91 commits (all time) y: 144 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventM365D.yaml x: 196 commits (all time) y: 207 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventMicrosoftSharePoint.yaml x: 158 commits (all time) y: 232 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventSentinelOne.yaml x: 108 commits (all time) y: 172 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventVMwareCarbonBlackCloud.yaml x: 66 commits (all time) y: 211 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoISE.yaml x: 114 commits (all time) y: 159 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCrowdStrikeFalconHost.yaml x: 45 commits (all time) y: 296 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionForcePointFirewall.yaml x: 62 commits (all time) y: 341 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionFortinetFortiGate.yaml x: 224 commits (all time) y: 120 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoft365Defender.yaml x: 182 commits (all time) y: 194 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionVMwareCarbonBlackCloud.yaml x: 64 commits (all time) y: 250 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoFirepower.yaml x: 59 commits (all time) y: 318 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoISE.yaml x: 115 commits (all time) y: 226 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCrowdStrikeFalconHost.yaml x: 46 commits (all time) y: 393 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionForcePointFirewall.yaml x: 57 commits (all time) y: 416 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionFortinetFortiGate.yaml x: 221 commits (all time) y: 176 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoft365Defender.yaml x: 209 commits (all time) y: 274 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSentinelOne.yaml x: 62 commits (all time) y: 228 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionVMwareCarbonBlackCloud.yaml x: 65 commits (all time) y: 331 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessTerminateVMwareCarbonBlackCloud.yaml x: 47 commits (all time) y: 112 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftWindowsEvents.yaml x: 147 commits (all time) y: 148 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateTrendMicroVisionOne.yaml x: 40 commits (all time) y: 200 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateVMwareCarbonBlackCloud.yaml x: 59 commits (all time) y: 331 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessEmpty.yaml x: 167 commits (all time) y: 177 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessEventNative.yaml x: 58 commits (all time) y: 137 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMicrosoftSecurityEvents.yaml x: 108 commits (all time) y: 118 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMicrosoftWindowsEvents.yaml x: 144 commits (all time) y: 133 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateVMwareCarbonBlackCloud.yaml x: 48 commits (all time) y: 187 lines of code Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventMicrosoft365D.yaml x: 58 commits (all time) y: 108 lines of code Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventTrendMicroVisionOne.yaml x: 47 commits (all time) y: 72 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoft365D.yaml x: 77 commits (all time) y: 158 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventSentinelOne.yaml x: 110 commits (all time) y: 160 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventTrendMicroVisionOne.yaml x: 49 commits (all time) y: 100 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionApacheHTTPServer.yaml x: 65 commits (all time) y: 71 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionCitrixNetScaler.yaml x: 57 commits (all time) y: 154 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionFortinetFortiGate.yaml x: 115 commits (all time) y: 151 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionIIS.yaml x: 48 commits (all time) y: 87 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionApacheHTTPServer.yaml x: 106 commits (all time) y: 135 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionCiscoFirepower.yaml x: 59 commits (all time) y: 268 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionCitrixNetScaler.yaml x: 57 commits (all time) y: 219 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionF5ASM.yaml x: 55 commits (all time) y: 163 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionFortinetFortiGate.yaml x: 115 commits (all time) y: 212 lines of code Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/AddTagsToResource/__init__.py x: 65 commits (all time) y: 85 lines of code Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/GetInventory/__init__.py x: 64 commits (all time) y: 96 lines of code Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/StopAutomationExecution/__init__.py x: 64 commits (all time) y: 78 lines of code Solutions/Alsid For AD/Parsers/afad_parser.yaml x: 69 commits (all time) y: 113 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_CreatedCRUDDyanmoDBPolicytoPrivilegeEscalation.yaml x: 159 commits (all time) y: 77 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_S3BruteForce.yaml x: 92 commits (all time) y: 64 lines of code Solutions/Amazon Web Services/Analytic Rules/SuspiciousAWSCLICommandExecution.yaml x: 109 commits (all time) y: 67 lines of code Solutions/Apache Log4j Vulnerability Detection/Hunting Queries/WAF_log4j_vulnerability.yaml x: 125 commits (all time) y: 47 lines of code Solutions/ApacheHTTPServer/Parsers/ApacheHTTPServer.yaml x: 69 commits (all time) y: 58 lines of code Solutions/Armis/Parsers/ArmisAlerts.yaml x: 69 commits (all time) y: 38 lines of code Solutions/Attacker Tools Threat Protection Essentials/Analytic Rules/powershell_empire.yaml x: 102 commits (all time) y: 146 lines of code Solutions/Authomize/Data Connectors/AuthomizeSentinelConnector/__init__.py x: 57 commits (all time) y: 123 lines of code Solutions/Authomize/Hunting queries/Admin_SaaS_account_detected.yaml x: 57 commits (all time) y: 4 lines of code Solutions/Authomize/Hunting queries/Chain_of_3_or_more_roles.yaml x: 58 commits (all time) y: 24 lines of code Solutions/Azure Activity/Hunting Queries/AzureRunCommandFromAzureIP.yaml x: 77 commits (all time) y: 49 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Port Scan.yaml x: 175 commits (all time) y: 51 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Port Sweep.yaml x: 190 commits (all time) y: 59 lines of code Solutions/Azure SQL Database solution for sentinel/Analytic Rules/Detection-ErrorsCredentialStatefulAnomalyOnDatabase.yaml x: 85 commits (all time) y: 86 lines of code Solutions/Azure SQL Database solution for sentinel/Analytic Rules/Detection-HotwordsFirewallRuleStatefulAnomalyOnDatabase.yaml x: 87 commits (all time) y: 93 lines of code Solutions/Azure SQL Database solution for sentinel/Hunting Queries/HuntingQuery-AffectedRowAnomaly.yaml x: 75 commits (all time) y: 66 lines of code Solutions/Azure SQL Database solution for sentinel/Hunting Queries/HuntingQuery-BooleanBlindSQLi.yaml x: 126 commits (all time) y: 88 lines of code Solutions/Bitglass/Parsers/Bitglass.yaml x: 69 commits (all time) y: 160 lines of code Solutions/Blackberry CylancePROTECT/Parsers/CylancePROTECT-old.yaml x: 69 commits (all time) y: 126 lines of code Solutions/Box/Data Connectors/AzureFunctionBox/main.py x: 173 commits (all time) y: 158 lines of code Solutions/Business Email Compromise - Financial Fraud/Hunting Queries/AWSBucketAPILogs-S3BucketDataTransferTimeSeriesAnomaly.yaml x: 106 commits (all time) y: 54 lines of code Solutions/CTM360/Data Connectors/CBS/AzureFunctionCTM360_CBS/__init__.py x: 43 commits (all time) y: 149 lines of code Solutions/Cisco SD-WAN/Parsers/CiscoSDWANNetflow.yaml x: 69 commits (all time) y: 243 lines of code Solutions/CiscoDuoSecurity/Data Connectors/AzureFunctionCiscoDuo/main.py x: 294 commits (all time) y: 373 lines of code Solutions/Citrix ADC/Parsers/CitrixADCEventOld.yaml x: 69 commits (all time) y: 168 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/StsRefreshTokenModification.yaml x: 157 commits (all time) y: 67 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/UserGrantedAccess_GrantsOthersAccess.yaml x: 76 commits (all time) y: 76 lines of code Solutions/Cloud Service Threat Protection Essentials/Hunting Queries/AzureKeyVaultAccessManipulation.yaml x: 73 commits (all time) y: 50 lines of code Solutions/Cloudflare/Parsers/Cloudflare.yaml x: 69 commits (all time) y: 221 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/CofenseIntelligenceMalware/__init__.py x: 61 commits (all time) y: 13 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/CofenseIntelligenceMalware/cofense_malware_data_to_sentinel.py x: 62 commits (all time) y: 391 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/CofenseToSentinel/cofense_to_sentinel_mapping.py x: 61 commits (all time) y: 60 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/CofenseToSentinel/sentinel.py x: 62 commits (all time) y: 126 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/RetryFailedIndicators/retry_failed_indicators.py x: 62 commits (all time) y: 269 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/RetryFailedIndicators/sentinel.py x: 62 commits (all time) y: 111 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SentinelToDefender/defender.py x: 61 commits (all time) y: 283 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SentinelToDefender/sentinel.py x: 62 commits (all time) y: 711 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SentinelToDefender/sentinel_to_defender_mapping.py x: 62 commits (all time) y: 151 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SharedCode/utils.py x: 62 commits (all time) y: 433 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/IndicatorCreatorToDefender/defender.py x: 41 commits (all time) y: 281 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/IndicatorCreatorToDefender/sentinel.py x: 41 commits (all time) y: 751 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/IndicatorCreatorToDefender/sentinel_to_defender_mapping.py x: 41 commits (all time) y: 168 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/NonCofenseBasedIndicatorCreatorToCofense/cofense.py x: 41 commits (all time) y: 330 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/NonCofenseBasedIndicatorCreatorToCofense/sentinel.py x: 41 commits (all time) y: 727 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/SharedCode/__init__.py x: 41 commits (all time) y: 1 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/SharedCode/utils.py x: 41 commits (all time) y: 444 lines of code Solutions/CognyteLuminar/Data Connectors/Cognyte Luminar/__init__.py x: 55 commits (all time) y: 403 lines of code Solutions/Corelight/Hunting Queries/CorelightRarePOST.yaml x: 144 commits (all time) y: 31 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/Data Collection Rules/Transformations/ASimAuthenticationEventCrowdStrikeFalcon.yaml x: 54 commits (all time) y: 79 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/Data Collection Rules/Transformations/ASimProcessEventCrowdStrikeFalcon.yaml x: 54 commits (all time) y: 86 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/Data Collection Rules/Transformations/ASimRegistryEventCrowdStrikeFalcon.yaml x: 54 commits (all time) y: 57 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Parsers/CrowdStrikeReplicator.yaml x: 70 commits (all time) y: 1074 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Parsers/CrowdStrikeReplicatorV2.yaml x: 108 commits (all time) y: 155 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Parsers/CrowdStrikeReplicator_future.yaml x: 60 commits (all time) y: 1123 lines of code Solutions/DNS Essentials/Analytic Rules/MultipleErrorsReportedForSameDNSQueryAnomalyBased.yaml x: 68 commits (all time) y: 121 lines of code Solutions/DNS Essentials/Analytic Rules/PotentialDGADetectedviaRepetitiveFailuresAnomalyBased.yaml x: 68 commits (all time) y: 144 lines of code Solutions/DNS Essentials/Analytic Rules/PotentialDGADetectedviaRepetitiveFailuresStaticThresholdBased.yaml x: 68 commits (all time) y: 67 lines of code Solutions/Darktrace/Analytic Rules/CreateAlertFromModelBreach.yaml x: 149 commits (all time) y: 75 lines of code Solutions/Darktrace/Analytic Rules/CreateAlertFromSystemStatus.yaml x: 150 commits (all time) y: 56 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlertsManualActivity/dataminrpulse_integration_settings.py x: 100 commits (all time) y: 341 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlertsSentinelActivity/dataminr_pulse.py x: 60 commits (all time) y: 288 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlertsSentinelOrchestrator/__init__.py x: 59 commits (all time) y: 10 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseThreatIntelligence/dataminr_pulse_threat_intelligence.py x: 71 commits (all time) y: 235 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseThreatIntelligence/dataminr_pulse_to_threat_intelligence_mapping.py x: 70 commits (all time) y: 118 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseThreatIntelligence/sentinel.py x: 61 commits (all time) y: 193 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/RetryFailedIndicators/post_to_log_analytics.py x: 59 commits (all time) y: 115 lines of code Solutions/Digital Shadows/Data Connectors/Digital Shadows/DigitalShadowsConnectorAzureFunction/DS_api.py x: 107 commits (all time) y: 98 lines of code Solutions/Egress Defend/Analytic Rules/DangerousAttachmentReceived.yaml x: 62 commits (all time) y: 55 lines of code Solutions/FalconFriday/Analytic Rules/AzureADRareUserAgentAppSignin.yaml x: 132 commits (all time) y: 107 lines of code Solutions/FireEye Network Security/Parsers/FireEyeNXEvent.yaml x: 69 commits (all time) y: 70 lines of code Solutions/GitHub/Data Connectors/GithubWebhook/GithubWebhookConnector/__init__.py x: 156 commits (all time) y: 99 lines of code Solutions/GoogleCloudPlatformDNS/Data Connectors/AzureFunctionGCPDNS/main.py x: 91 commits (all time) y: 99 lines of code Solutions/GoogleWorkspaceReports/Parsers/GWorkspaceActivityReports.yaml x: 69 commits (all time) y: 204 lines of code Solutions/GreyNoiseThreatIntelligence/Data Connectors/GreyNoiseAPISentinelConnector/main.py x: 106 commits (all time) y: 300 lines of code Solutions/Illumio Core/Parsers/IllumioCoreEvent.yaml x: 69 commits (all time) y: 194 lines of code Solutions/Juniper SRX/Parsers/JuniperSRX.yaml x: 87 commits (all time) y: 101 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/AquaBlizzardFeb2022.yaml x: 42 commits (all time) y: 170 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/CaramelTsunami_IOC.yaml x: 42 commits (all time) y: 199 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/ChiaCryptoMining.yaml x: 42 commits (all time) y: 225 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/Dev-0530_July2022.yaml x: 42 commits (all time) y: 164 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/ExchangeServerVulnerabilitiesMarch2021IoCs.yaml x: 42 commits (all time) y: 130 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/MidnightBlizzard_IOCsMay2021.yaml x: 42 commits (all time) y: 184 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/PHOSPHORUSMarch2019IOCs.yaml x: 42 commits (all time) y: 113 lines of code Solutions/Legacy IOC based Threat Protection/Hunting Queries/NetworkConnectiontoOMIPorts.yaml x: 153 commits (all time) y: 63 lines of code Solutions/Lookout Cloud Security Platform for Microsoft Sentinel/Data Connectors/LookoutCSConnector/LookoutCloudSecurityAnamolies/__init__.py x: 110 commits (all time) y: 340 lines of code Solutions/Malware Protection Essentials/Analytic Rules/StartupRegistryModified.yaml x: 39 commits (all time) y: 125 lines of code Solutions/Malware Protection Essentials/Hunting Queries/FilesWithRansomwareExtensions.yaml x: 39 commits (all time) y: 95 lines of code Solutions/McAfee ePolicy Orchestrator/Parsers/McAfeeEPOEvent.yaml x: 127 commits (all time) y: 200 lines of code Solutions/Microsoft 365/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml x: 77 commits (all time) y: 22 lines of code Solutions/Microsoft Entra ID/Analytic Rules/MultipleAdmin_membership_removals_from_NewAdmin.yaml x: 92 commits (all time) y: 109 lines of code Solutions/Microsoft Entra ID/Analytic Rules/PIMElevationRequestRejected.yaml x: 91 commits (all time) y: 74 lines of code Solutions/Microsoft Entra ID/Analytic Rules/RareApplicationConsent.yaml x: 90 commits (all time) y: 96 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Analytic Rules/ServerOrientedWithUserOrientedAdministration.yaml x: 170 commits (all time) y: 77 lines of code Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskHighUserAlertsCorrelation.yaml x: 158 commits (all time) y: 101 lines of code Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskSensitiveDataAccessOutsideOrgGeo.yaml x: 185 commits (all time) y: 57 lines of code Solutions/MimecastAudit/Data Connectors/Helpers/request_helper.py x: 58 commits (all time) y: 121 lines of code Solutions/MimecastAudit/Data Connectors/Models/Enum/__init__.py x: 58 commits (all time) y: 1 lines of code Solutions/MimecastSEG/Data Connectors/Helpers/request_helper.py x: 54 commits (all time) y: 106 lines of code Solutions/MimecastTIRegional/Data Connectors/Helpers/threat_intel_feed_request_helper.py x: 86 commits (all time) y: 171 lines of code Solutions/MimecastTIRegional/Data Connectors/Helpers/threat_intel_feed_response_helper.py x: 55 commits (all time) y: 104 lines of code Solutions/MimecastTIRegional/Data Connectors/Models/Enum/__init__.py x: 55 commits (all time) y: 1 lines of code Solutions/MimecastTTP/Analytic Rules/MimecastTTPAttachment.yaml x: 61 commits (all time) y: 47 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/UserImpersonateByRiskyUser.yaml x: 58 commits (all time) y: 72 lines of code Solutions/Netskope/Data Connectors/Netskope/AzureFunctionNetskope/run.ps1 x: 122 commits (all time) y: 388 lines of code Solutions/Netskope/Parsers/Netskope.yaml x: 69 commits (all time) y: 288 lines of code Solutions/Okta Single Sign-On/Data Connectors/OktaSingleSign-On/AzureFunctionOktaSSO_V2/AzureFunctionOktaSSO/run.ps1 x: 51 commits (all time) y: 167 lines of code Solutions/Okta Single Sign-On/Data Connectors/OktaSingleSign-On/AzureFunctionOktaSSO_V2/requirements.psd1 x: 51 commits (all time) y: 8 lines of code Solutions/OneLoginIAM/Parsers/OneLogin.yaml x: 107 commits (all time) y: 589 lines of code Solutions/OracleWebLogicServer/Parsers/OracleWebLogicServerEvent.yaml x: 109 commits (all time) y: 79 lines of code Solutions/PDNS Block Data Connector/DataConnectors/block-data-connector/__init__.py x: 67 commits (all time) y: 101 lines of code Solutions/ProofPointTap/Data Connectors/AzureFunctionProofpointTAP/run.ps1 x: 95 commits (all time) y: 155 lines of code Solutions/Qualys VM Knowledgebase/Data Connectors/AzureFunctionQualysKB/run.ps1 x: 159 commits (all time) y: 262 lines of code Solutions/Rapid7InsightVM/Data Connectors/InsightVMCloudAPISentinelConnector/__init__.py x: 150 commits (all time) y: 218 lines of code Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.yaml x: 69 commits (all time) y: 227 lines of code Solutions/Snowflake/Hunting Queries/SnowflakeHighCreditConsumingQueries.yaml x: 110 commits (all time) y: 26 lines of code Solutions/Threat Intelligence/Hunting Queries/FileEntity_VMConnection.yaml x: 161 commits (all time) y: 70 lines of code Solutions/Training/Azure-Sentinel-Training-Lab/Artifacts/Scripts/IngestCSV.ps1 x: 81 commits (all time) y: 181 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/oat_pipeline_task_qt/__init__.py x: 81 commits (all time) y: 70 lines of code Solutions/UEBA Essentials/Hunting Queries/Anomalous AAD Account Manipulation.yaml x: 109 commits (all time) y: 26 lines of code Solutions/UEBA Essentials/Hunting Queries/newAccountAddedToAdminGroup.yaml x: 166 commits (all time) y: 22 lines of code Solutions/Vectra AI Stream/Parsers/VectraStream_function.yaml x: 69 commits (all time) y: 460 lines of code Solutions/Web Session Essentials/Analytic Rules/MultipleServerErrorsWithinShortTime.yaml x: 68 commits (all time) y: 70 lines of code Solutions/Web Shells Threat Protection/Hunting Queries/PotentialWebshell.yaml x: 157 commits (all time) y: 30 lines of code Solutions/Windows Server DNS/Hunting Queries/DNS_CommonlyAbusedTLDs.yaml x: 73 commits (all time) y: 7 lines of code Solutions/Windows Server DNS/Hunting Queries/DNS_DomainAnomalousLookupIncrease.yaml x: 73 commits (all time) y: 73 lines of code Solutions/Windows Server DNS/Hunting Queries/DNS_FullNameAnomalousLookupIncrease.yaml x: 73 commits (all time) y: 69 lines of code Solutions/Windows Server DNS/Hunting Queries/DNS_HighPercentNXDomainCount.yaml x: 94 commits (all time) y: 100 lines of code Solutions/ZeroNetworks/Playbooks/ZeroNetworksConnector/ZeroNetworks-swagger.yaml x: 37 commits (all time) y: 379 lines of code Solutions/Zinc Open Source/Analytic Rules/ZincOctober2022_Filename_Commandline_IOC.yaml x: 137 commits (all time) y: 76 lines of code Solutions/ZoomReports/Data Connectors/ZoomSentinelConnector/__init__.py x: 110 commits (all time) y: 299 lines of code Tools/Archive-Log-Tool/ArchiveLogsTool-PowerShell/Configure-Long-Term-Retention.ps1 x: 189 commits (all time) y: 510 lines of code Tools/Create-Azure-Sentinel-Solution/V2/createSolutionV2.ps1 x: 597 commits (all time) y: 2512 lines of code Tools/Create-Azure-Sentinel-Solution/common/LogAppInsights.ps1 x: 66 commits (all time) y: 387 lines of code Tools/Playbook-ARM-Template-Generator/src/Playbook_ARM_Template_Generator.ps1 x: 79 commits (all time) y: 526 lines of code Tools/Sentinel-All-In-One/v1/Powershell/DeleteConnectors.ps1 x: 40 commits (all time) y: 108 lines of code Tools/Sentinel-All-In-One/v1/Powershell/SentinelallInOne.ps1 x: 40 commits (all time) y: 383 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/ZAP/Total ZAP Count.yaml x: 1 commits (all time) y: 20 lines of code Solutions/Radiflow/Analytic Rules/RadiflowUnauthorizedCommandInOperationalDevice.yaml x: 1 commits (all time) y: 33 lines of code Tools/Create-Azure-Sentinel-Solution/createSolution.ps1 x: 282 commits (all time) y: 1314 lines of code Hunting Queries/AuditLogs/UserGrantedAccess_GrantsOthersAccess.yaml x: 140 commits (all time) y: 4 lines of code Hunting Queries/AzureActivity/AzureSentinelConnectors_AdministrativeOperations.yaml x: 150 commits (all time) y: 3 lines of code Hunting Queries/DnsEvents/DNS_HighPercentNXDomainCount.yaml x: 139 commits (all time) y: 4 lines of code Hunting Queries/DnsEvents/DNS_WannaCry.yaml x: 154 commits (all time) y: 4 lines of code Hunting Queries/OfficeActivity/TeamsFilesUploaded.yaml x: 102 commits (all time) y: 4 lines of code Hunting Queries/SecurityEvent/CommandsexecutedbyWMIonnewhosts-potentialImpacket.yaml x: 90 commits (all time) y: 4 lines of code Hunting Queries/SecurityEvent/DecoyUserAccountAuthenticationAttempt.yaml x: 91 commits (all time) y: 4 lines of code Hunting Queries/SecurityEvent/RareProcess_forWinHost.yaml x: 94 commits (all time) y: 4 lines of code Hunting Queries/SecurityEvent/RemoteLoginPerformedwithWMI.yaml x: 98 commits (all time) y: 4 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventAzureAdminActivity.yaml x: 76 commits (all time) y: 155 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventMicrosoftExchangeAdmin365.yaml x: 72 commits (all time) y: 122 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventAzureAdminActivity.yaml x: 72 commits (all time) y: 216 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftExchangeAdmin365.yaml x: 72 commits (all time) y: 191 lines of code Parsers/ASimDns/Parsers/vimDnsNative.yaml x: 209 commits (all time) y: 103 lines of code Parsers/ASimDns/Parsers/vimDnsZscalerZIA.yaml x: 101 commits (all time) y: 132 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCheckPointFirewall.yaml x: 132 commits (all time) y: 268 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAppGateSDP.yaml x: 151 commits (all time) y: 232 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCheckPointFirewall.yaml x: 120 commits (all time) y: 325 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftLinuxSysmon.yaml x: 223 commits (all time) y: 204 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionzScalerZIA.yaml x: 195 commits (all time) y: 168 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionEmpty.yaml x: 197 commits (all time) y: 179 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionNative.yaml x: 47 commits (all time) y: 126 lines of code Solutions/CohesitySecurity/build_one_solution.ps1 x: 45 commits (all time) y: 1315 lines of code Solutions/ProofPointTap/Data Connectors/requirements.psd1 x: 50 commits (all time) y: 7 lines of code Solutions/1Password/Analytics Rules/1Password - Manual Account Creation.yaml x: 2 commits (all time) y: 55 lines of code ASIM/lib/functions/ASIM_LookupDnsQueryType.yaml x: 63 commits (all time) y: 117 lines of code ASIM/lib/functions/ASIM_LookupHTTPStatusCode.yaml x: 76 commits (all time) y: 228 lines of code ASIM/lib/functions/ASIM_LookupICMPType.yaml x: 63 commits (all time) y: 75 lines of code ASIM/lib/functions/ASIM_LookupNetworkProtocol.yaml x: 63 commits (all time) y: 176 lines of code ASIM/lib/functions/ASIM_ResolveDnsQueryType.yaml x: 101 commits (all time) y: 120 lines of code ASIM/lib/functions/ASIM_ResolveDstFQDN.yaml x: 102 commits (all time) y: 26 lines of code ASIM/lib/functions/ASIM_ResolveICMPType.yaml x: 101 commits (all time) y: 78 lines of code ASIM/lib/functions/ASIM_ResolveNetworkProtocol.yaml x: 101 commits (all time) y: 179 lines of code DataConnectors/AWS-CloudTrail-AzureFunction/AzFunAWSCloudTrailLogsIngestion/__init__.py x: 21 commits (all time) y: 378 lines of code DataConnectors/AWS-S3-AzureFunction/AzFun-AWS-S3-Ingestion/__init__.py x: 50 commits (all time) y: 512 lines of code DataConnectors/AWS-S3/Utils/HelperFunctions.ps1 x: 56 commits (all time) y: 227 lines of code DataConnectors/AzureStorage/GetAzureStorageLogsFunction.cs x: 12 commits (all time) y: 327 lines of code DataConnectors/AzureStorage/LogDownloader.cs x: 9 commits (all time) y: 77 lines of code DataConnectors/CEF/cef_gather_info.py x: 81 commits (all time) y: 95 lines of code DataConnectors/DocuSign-SecurityEvents/Application_Consent.ps1 x: 27 commits (all time) y: 63 lines of code DataConnectors/Duo Security/AzureFunctionDuoSecurity/run.ps1 x: 54 commits (all time) y: 250 lines of code DataConnectors/Fluentd-VMSS/plugin/cef_version_0_keys.yaml x: 9 commits (all time) y: 166 lines of code DataConnectors/Fluentd-VMSS/plugin/out_remote_syslog-as.rb x: 9 commits (all time) y: 132 lines of code DataConnectors/Fluentd-VMSS/plugin/parser_cef-as.rb x: 9 commits (all time) y: 203 lines of code DataConnectors/JSON-Import/dotnet_loganalytics_json_import/Program.cs x: 10 commits (all time) y: 43 lines of code DataConnectors/JumpCloud Single Sign On/AzureFunctionJumpCloud/JCQueueTrigger1/run.ps1 x: 17 commits (all time) y: 133 lines of code DataConnectors/JumpCloud Single Sign On/AzureFunctionJumpCloud/profile.ps1 x: 17 commits (all time) y: 18 lines of code DataConnectors/MCASActivityFunction/AzureFunctionMCASActivity/MCASActivityTimerTrigger/run.ps1 x: 75 commits (all time) y: 304 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Common/ExponentialBackoff.cs x: 9 commits (all time) y: 35 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Common/RetryWithExponentialBackoff.cs x: 10 commits (all time) y: 38 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Models/AuditDetailedReport.cs x: 9 commits (all time) y: 49 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Processor/Processor.cs x: 10 commits (all time) y: 201 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Serverless/EgressTeamsLogs.cs x: 10 commits (all time) y: 102 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.StorageHandler/StorageHandler.cs x: 26 commits (all time) y: 113 lines of code DataConnectors/Qualys VM/AzureFunctionQualysVM/run.ps1 x: 64 commits (all time) y: 212 lines of code DataConnectors/S3-Lambda/S3toSentinel.ps1 x: 20 commits (all time) y: 227 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_PowerShell/profile.ps1 x: 8 commits (all time) y: 18 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_PowerShell/requirements.psd1 x: 8 commits (all time) y: 7 lines of code DataConnectors/microsoft-logstash-output-azure-loganalytics/lib/logstash/logAnalyticsClient/logstashLoganalyticsConfiguration.rb x: 12 commits (all time) y: 115 lines of code Exploration Queries/InputEntity_Host/ConnectionData_DefenderForIoT_GetHost2IoTDevice.yaml x: 53 commits (all time) y: 50 lines of code Hunting Queries/AzureDevOpsAuditing/ADOBuildDeletedAfterPipelineMod.yaml x: 66 commits (all time) y: 4 lines of code Hunting Queries/AzureDevOpsAuditing/Project visibility changed to public.yaml x: 70 commits (all time) y: 4 lines of code Hunting Queries/Microsoft 365 Defender/Campaigns/confluence-weblogic-targeted.yaml x: 40 commits (all time) y: 70 lines of code Hunting Queries/Microsoft 365 Defender/Campaigns/fireeye-red-team-tools-HASHs [Nobelium].yaml x: 40 commits (all time) y: 335 lines of code Hunting Queries/Microsoft 365 Defender/General queries/Baseline Comparison.yaml x: 39 commits (all time) y: 257 lines of code Hunting Queries/Microsoft 365 Defender/Ransomware/DEV-0270/Modifying the registry to add a ransom message notification.yaml x: 48 commits (all time) y: 13 lines of code Hunting Queries/MultipleDataSources/FireEyeRedTeamComms.yaml x: 53 commits (all time) y: 99 lines of code Hunting Queries/MultipleDataSources/StorageAccountKeyEnumerationWithSigninandAuditlogs.yaml x: 39 commits (all time) y: 58 lines of code Hunting Queries/MultipleDataSources/UserGrantedAccess_CreatesResources.yaml x: 53 commits (all time) y: 87 lines of code Hunting Queries/SigninLogs/UserAccountsMeasurableincreaseofsuccessfulsignins.yaml x: 50 commits (all time) y: 66 lines of code Parsers/ASimDns/Parsers/ASimDnsCorelightZeek.yaml x: 123 commits (all time) y: 204 lines of code Parsers/ASimDns/Parsers/ASimDnsMicrosoftOMS.yaml x: 85 commits (all time) y: 206 lines of code Parsers/ASimDns/Parsers/vimDnsCorelightZeek.yaml x: 123 commits (all time) y: 256 lines of code Parsers/ASimDns/Parsers/vimDnsEmpty.yaml x: 104 commits (all time) y: 173 lines of code Parsers/ASimDns/Parsers/vimDnsMicrosoftOMS.yaml x: 85 commits (all time) y: 256 lines of code Parsers/ASimDns/Parsers/vimDnsVectraAI.yaml x: 56 commits (all time) y: 144 lines of code Parsers/ASimNetworkSession/ASimNetworkSessionV1/NetworkSessionEmpty.yaml x: 47 commits (all time) y: 143 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionAWSVPC.yaml x: 111 commits (all time) y: 230 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionAzureFirewall.yaml x: 83 commits (all time) y: 99 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCorelightZeek.yaml x: 88 commits (all time) y: 129 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMD4IoTAgent.yaml x: 31 commits (all time) y: 122 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftLinuxSysmon.yaml x: 176 commits (all time) y: 120 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionVMConnection.yaml x: 152 commits (all time) y: 153 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionWatchGuardFirewareOS.yaml x: 53 commits (all time) y: 130 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAzureNSG.yaml x: 119 commits (all time) y: 155 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionEmpty.yaml x: 134 commits (all time) y: 164 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMD4IoTAgent.yaml x: 31 commits (all time) y: 208 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionVectraAI.yaml x: 57 commits (all time) y: 196 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessEventMicrosoft365D.yaml x: 114 commits (all time) y: 93 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateLinuxSysmon.yaml x: 64 commits (all time) y: 171 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateMD4IoT.yaml x: 51 commits (all time) y: 123 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftSecurityEvents.yaml x: 94 commits (all time) y: 184 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessEventMicrosoft365D.yaml x: 139 commits (all time) y: 176 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMD4IoT.yaml x: 50 commits (all time) y: 123 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionSquidProxy.yaml x: 145 commits (all time) y: 79 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionVectraAI.yaml x: 98 commits (all time) y: 132 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionSquidProxy.yaml x: 173 commits (all time) y: 141 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionVectraAI.yaml x: 98 commits (all time) y: 196 lines of code Parsers/PAN_Parser.csl x: 86 commits (all time) y: 78 lines of code Playbooks/Get-AlertEntitiesEnrichment/Deploy.ps1 x: 35 commits (all time) y: 6 lines of code Playbooks/PaloAlto-Wildfire/XMLResponse.xml x: 18 commits (all time) y: 9 lines of code Solutions/ALC-WebCTRL/Data Connectors/TaskSetup/ALC-WebCTRL-AuditPull.ps1 x: 32 commits (all time) y: 103 lines of code Solutions/Agari/Data Connectors/AzureFunctionAgari/run.ps1 x: 21 commits (all time) y: 451 lines of code Solutions/Agari/Data Connectors/requirements.psd1 x: 21 commits (all time) y: 7 lines of code Solutions/Alibaba Cloud/DataConnectors/AliCloudSentinelConnector/__init__.py x: 89 commits (all time) y: 145 lines of code Solutions/Bitglass/Data Connectors/BitglassSentinelConnector/__init__.py x: 22 commits (all time) y: 194 lines of code Solutions/Cisco Secure Endpoint/Data Connectors/AzureFunctionCiscoSecureEndpoint/main.py x: 76 commits (all time) y: 151 lines of code Solutions/Lookout/Data Connectors/LookoutAPISentinelConnector/__init__.py x: 46 commits (all time) y: 92 lines of code Solutions/MaturityModelForEventLogManagementM2131/Analytic Rules/M2131RecommendedDatatableUnhealthy.yaml x: 121 commits (all time) y: 90 lines of code Solutions/Mulesoft/Data Connectors/MuleSoftCloudhubSentinelConnector/__init__.py x: 51 commits (all time) y: 109 lines of code Solutions/Oracle Cloud Infrastructure/Data Connectors/AzureFunctionOCILogs/sentinel_connector.py x: 46 commits (all time) y: 100 lines of code Solutions/PaloAltoPrismaCloud/Data Connectors/AzureFunctionPrismaCloud/main.py x: 74 commits (all time) y: 193 lines of code Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml x: 35 commits (all time) y: 16 lines of code Solutions/SAP/template/loggingconfig_DEV.yaml x: 65 commits (all time) y: 195 lines of code Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor/SecurityScorecardFactorSentinelConnector/writers.py x: 31 commits (all time) y: 188 lines of code Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue/SecurityScorecardIssueSentinelConnector/scorecard.py x: 31 commits (all time) y: 89 lines of code Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings/SecurityScorecardRatingsSentinelConnector/scorecard.py x: 31 commits (all time) y: 62 lines of code Solutions/SlackAudit/Data Connectors/SlackAuditAPISentinelConnector/__init__.py x: 25 commits (all time) y: 278 lines of code Solutions/Synack/Integrations/AzureFunctionSynack/azure-service.js x: 70 commits (all time) y: 173 lines of code Solutions/Synack/Integrations/AzureFunctionSynack/synack-service.js x: 70 commits (all time) y: 111 lines of code Solutions/Synack/Integrations/AzureFunctionSynack/sync-service.js x: 70 commits (all time) y: 220 lines of code Solutions/TenableIO/Data Connectors/TenableExportStarter/__init__.py x: 21 commits (all time) y: 117 lines of code Solutions/TenableIO/Data Connectors/TenableProcessVulnChunkFromQueue/__init__.py x: 39 commits (all time) y: 71 lines of code Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCASSentinelConnector/__init__.py x: 25 commits (all time) y: 183 lines of code Solutions/Workplace from Facebook/Data Connectors/WorkplaceFacebook/WorkplaceWebhooksTrigger/__init__.py x: 35 commits (all time) y: 92 lines of code Solutions/ZeroNetworks/Data Connectors/SegmentFunctionConnector/AzureFunction_ZeroNetworks_Segment_Audit/ZeroNetworks_Segment_Audit_TimeTrigger/run.ps1 x: 32 commits (all time) y: 129 lines of code Tools/Az.SecurityInsights-Samples/Alert Rules/Export Analytics Rules/exportAzureSentinelRules.ps1 x: 50 commits (all time) y: 91 lines of code Tools/Az.SecurityInsights-Samples/Alert Rules/Import GitHub YAML rules/ImportGitHubYAMLrules.ps1 x: 31 commits (all time) y: 158 lines of code Tools/AzureDataExplorer/CreateTables_ADX/Create-LA-Tables-ADX.ps1 x: 19 commits (all time) y: 318 lines of code Tools/AzureDataExplorer/Migrate-LA-to-ADX.ps1 x: 90 commits (all time) y: 613 lines of code Tools/AzureDataExplorer/Pipeline/Migrate-LA-to-ADX-Pipeline.ps1 x: 20 commits (all time) y: 611 lines of code Tools/CustomLogsIngestion-DCE-DCR/src/Send-AzMonitorCustomLogs.ps1 x: 47 commits (all time) y: 190 lines of code Tools/ParameterizedFunction/AuditEventDataLookup_Func.ps1 x: 13 commits (all time) y: 136 lines of code Tools/PowerShell/Add-PlaybooksToSentinel/Add-PlaybooksToSentinel.ps1 x: 11 commits (all time) y: 136 lines of code Tools/PowerShell/Create-AnalyticsRulesFromTemplates/Create-AnalyticsRulesFromTemplates.ps1 x: 66 commits (all time) y: 162 lines of code Tools/Sample Code/HttpDataCollectorAPI/HttpDataCollectorAPI/Program.cs x: 8 commits (all time) y: 74 lines of code Tools/Sample-Data-Ingest-Tool/SampleDataIngestTool/AppConfig.cs x: 7 commits (all time) y: 33 lines of code Tools/Sample-Data-Ingest-Tool/SampleDataIngestTool/SampleDataPath.cs x: 10 commits (all time) y: 26 lines of code Tools/externaldata/appservicehttplogs.yaml x: 20 commits (all time) y: 5 lines of code Tools/externaldata/genstoragectxkql.ps1 x: 21 commits (all time) y: 88 lines of code Tutorials/Microsoft 365 Defender/Webcasts/Airlift 2021 - Lets Invoke.csl x: 24 commits (all time) y: 415 lines of code Watchlists/UpdateCloudIPs/AzureFunctionUpdateCloudIPs/UpdateCloudIPs/run.ps1 x: 36 commits (all time) y: 529 lines of code Solutions/AtlassianJiraAudit/Analytic Rules/JiraNewPrivilegedUser.yaml x: 106 commits (all time) y: 32 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoIse.yaml x: 9 commits (all time) y: 257 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoIse.yaml x: 9 commits (all time) y: 352 lines of code Parsers/ASimWebSession/Parsers/ASIMWebSessionIIS.yaml x: 36 commits (all time) y: 87 lines of code Solutions/Lookout/Data Connectors/LookoutAPISentinelConnector/mes_request.py x: 38 commits (all time) y: 186 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/AS_poller.py x: 1 commits (all time) y: 2 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/DS_api.py x: 1 commits (all time) y: 98 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/DS_poller.py x: 1 commits (all time) y: 140 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/state_serializer.py x: 1 commits (all time) y: 73 lines of code Detections/OfficeActivity/External User Added to Team and Immediately Uploads File.yaml x: 3 commits (all time) y: 5 lines of code Detections/AWSGuardDuty/AWS_GuardDuty_template.YAML x: 5 commits (all time) y: 4 lines of code
3543.0
lines of code
  min: 1.0
  average: 63.97
  25th percentile: 23.0
  median: 37.0
  75th percentile: 69.0
  max: 3543.0
0 759.0
commits (all time)
min: 1.0 | average: 83.34 | 25th percentile: 40.0 | median: 65.0 | 75th percentile: 110.0 | max: 759.0

File Size vs. Contributors (all time): 6180 points

Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CloudAppEvents_Updated.yaml x: 7 contributors (all time) y: 72 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DeviceNetworkEvents_Updated.yaml x: 7 contributors (all time) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_AzureActivity.yaml x: 8 contributors (all time) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_OfficeActivity.yaml x: 8 contributors (all time) y: 58 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 8 contributors (all time) y: 75 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureFirewall.yaml x: 7 contributors (all time) y: 69 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CloudAppEvents_Updated.yaml x: 7 contributors (all time) y: 4 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 53 contributors (all time) y: 78 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml x: 53 contributors (all time) y: 39 lines of code DataConnectors/AWS-S3/Utils/CommonAwsPolicies.ps1 x: 86 contributors (all time) y: 224 lines of code Solutions/AtlassianConfluenceAudit/Parsers/ConfluenceAudit.yaml x: 36 contributors (all time) y: 76 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAgentPoolCreatedDeleted.yaml x: 65 contributors (all time) y: 57 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAuditStreamDisabled.yaml x: 65 contributors (all time) y: 37 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOMaliciousToolingDetections1.yaml x: 43 contributors (all time) y: 36 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADONewExtensionAdded.yaml x: 62 contributors (all time) y: 41 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml x: 75 contributors (all time) y: 38 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml x: 75 contributors (all time) y: 65 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOSecretNotSecured.yaml x: 62 contributors (all time) y: 44 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml x: 73 contributors (all time) y: 53 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOAdminGroupAdditions.yaml x: 71 contributors (all time) y: 47 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOHistoricPrPolicyBypassing.yaml x: 77 contributors (all time) y: 52 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOHistoricServiceConnectionAdds.yaml x: 73 contributors (all time) y: 67 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOPatSessionMisuse.yaml x: 70 contributors (all time) y: 50 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOPipelineCreatedDeletedOneDay.yaml x: 64 contributors (all time) y: 69 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ExternalUpstreamSourceAddedtoAzureDevOpsFeed.yaml x: 61 contributors (all time) y: 55 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/NRT_ADOAuditStreamDisabled.yaml x: 64 contributors (all time) y: 33 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml x: 72 contributors (all time) y: 72 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/NewPAPCAPCASaddedtoADO.yaml x: 67 contributors (all time) y: 54 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml x: 65 contributors (all time) y: 27 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildDeletedAfterPipelineMod.yaml x: 48 contributors (all time) y: 19 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewAgentPoolCreated.yaml x: 48 contributors (all time) y: 6 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewPATOperation.yaml x: 48 contributors (all time) y: 33 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewReleaseApprover.yaml x: 48 contributors (all time) y: 42 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/Addtional Org Admin Added.yaml x: 33 contributors (all time) y: 30 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/AzDODisplayNameSwapping.yaml x: 33 contributors (all time) y: 25 lines of code Solutions/AzureDevOpsAuditing/Parsers/ADOAuditLogs.yaml x: 5 contributors (all time) y: 17 lines of code Solutions/ImpervaCloudWAF/Data Connectors/ImpervaWAFCloudSentinelConnector/__init__.py x: 91 contributors (all time) y: 221 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit logging disabled.yaml x: 13 contributors (all time) y: 68 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AnomalousUserAppSigninLocationIncrease-detection.yaml x: 47 contributors (all time) y: 38 lines of code Solutions/Microsoft Entra ID/Analytic Rules/DistribPassCrackAttempt.yaml x: 42 contributors (all time) y: 60 lines of code Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml x: 75 contributors (all time) y: 91 lines of code Solutions/QualysVM/Data Connectors/AzureFunctionQualysVM_V2/run.ps1 x: 31 contributors (all time) y: 285 lines of code Solutions/QualysVM/Parsers/QualysHostDetection.yaml x: 35 contributors (all time) y: 88 lines of code Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml x: 19 contributors (all time) y: 65 lines of code Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxApplicationPrivilegeEscalationOrChange.yaml x: 23 contributors (all time) y: 30 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_EvidenceOfMimikatzDCShadowAttack.yaml x: 57 contributors (all time) y: 23 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_RecentsIDHistoryChangesOnADObjects.yaml x: 66 contributors (all time) y: 33 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_WellKnownPrivilegedSIDsInsIDHistory.yaml x: 57 contributors (all time) y: 33 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_RBAC_Changes.yaml x: 67 contributors (all time) y: 61 lines of code Solutions/Semperis Directory Services Protector/Parsers/dsp_parser.yaml x: 43 contributors (all time) y: 44 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CommonSecurityLog.yaml x: 6 contributors (all time) y: 50 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_EmailUrlInfo_Updated.yaml x: 6 contributors (all time) y: 66 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_PaloAlto.yaml x: 6 contributors (all time) y: 108 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/FileHashEntity_DeviceFileEvents_Updated.yaml x: 6 contributors (all time) y: 38 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_imNetworkSession.yaml x: 7 contributors (all time) y: 106 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/URLEntity_PaloAlto.yaml x: 6 contributors (all time) y: 79 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_CustomSecurityLog.yaml x: 102 contributors (all time) y: 69 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_imWebSession.yaml x: 105 contributors (all time) y: 39 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/function_app.py x: 29 contributors (all time) y: 80 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/message_factory.py x: 29 contributors (all time) y: 526 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/withsecure_client.py x: 29 contributors (all time) y: 146 lines of code Tools/Create-Azure-Sentinel-Solution/arm-ttk/run-arm-ttk-in-automation.ps1 x: 30 contributors (all time) y: 45 lines of code Tools/Create-Azure-Sentinel-Solution/common/commonFunctions.ps1 x: 133 contributors (all time) y: 3350 lines of code Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 x: 50 contributors (all time) y: 921 lines of code DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 x: 89 contributors (all time) y: 299 lines of code DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 x: 65 contributors (all time) y: 97 lines of code DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 x: 100 contributors (all time) y: 270 lines of code DataConnectors/AWS-S3/Utils/AwsPoliciesUpdate.ps1 x: 32 contributors (all time) y: 125 lines of code DataConnectors/AWS-S3/Utils/AwsResourceCreator.ps1 x: 91 contributors (all time) y: 268 lines of code DataConnectors/AWS-S3/Utils/AwsSentinelTag.ps1 x: 26 contributors (all time) y: 15 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCDNLogsSetup/GCPCDNLogSetup.tf x: 9 contributors (all time) y: 86 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCloudIDSLogSetup/GCPCloudIDSLogSetup.tf x: 8 contributors (all time) y: 86 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPDNS_CCPLogsSetup/GCPDNSLogSetup.tf x: 13 contributors (all time) y: 82 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPIAMCCPLogsSetup/GCPIAMLOGS.tf x: 12 contributors (all time) y: 82 lines of code Detections/ASimProcess/SdeletedeployedviaGPOandrunrecursively(ASIMVersion).yaml x: 82 contributors (all time) y: 35 lines of code Hunting Queries/Microsoft 365 Defender/Defense evasion/suspicious-base64-encoded-registry-keys.yaml x: 11 contributors (all time) y: 26 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Email sender IP address Geo location information.yaml x: 13 contributors (all time) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml x: 13 contributors (all time) y: 30 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Email bombing.yaml x: 13 contributors (all time) y: 12 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Phish/Possible device code phishing attempts.yaml x: 13 contributors (all time) y: 47 lines of code Playbooks/Isolate-AzVM/Convert-SnapshotsToVHD.ps1 x: 7 contributors (all time) y: 195 lines of code Playbooks/Isolate-AzVM/Set-ManagedIdentity.ps1 x: 7 contributors (all time) y: 92 lines of code Solutions/AIShield AI Security Monitoring/Analytic Rules/BIIDetectionVulDetection.yaml x: 14 contributors (all time) y: 41 lines of code Solutions/AIShield AI Security Monitoring/Parsers/Guardian.yaml x: 14 contributors (all time) y: 27 lines of code Solutions/Armis/Data Connectors/ArmisDevice/ArmisDeviceSentinelConnector/__init__.py x: 68 contributors (all time) y: 456 lines of code Solutions/AtlassianConfluenceAudit/Data Connectors/AtlassianConfluenceAuditDataConnector/ConfluenceAuditAPISentinelConnector/__init__.py x: 9 contributors (all time) y: 115 lines of code Solutions/AtlassianConfluenceAudit/Data Connectors/AtlassianConfluenceAuditDataConnector/ConfluenceAuditAPISentinelConnector/state_manager.py x: 9 contributors (all time) y: 18 lines of code Solutions/Azure Activity/Analytic Rules/Machine_Learning_Creation.yaml x: 11 contributors (all time) y: 53 lines of code Solutions/Commvault Security IQ/Analytic Rules/CommvaultSecurityIQ_Alert.yaml x: 30 contributors (all time) y: 35 lines of code Solutions/Commvault Security IQ/Analytic Rules/Data_Alert.yaml x: 38 contributors (all time) y: 33 lines of code Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ/main.py x: 43 contributors (all time) y: 467 lines of code Solutions/Commvault Security IQ/Playbooks/Runbooks/Commvault_Disable_Data_Aging.py x: 26 contributors (all time) y: 78 lines of code Solutions/Commvault Security IQ/Playbooks/Runbooks/Commvault_Disable_IDP.py x: 26 contributors (all time) y: 50 lines of code Solutions/Commvault Security IQ/Tools/AssignLogicAppRoles.ps1 x: 9 contributors (all time) y: 67 lines of code Solutions/Commvault Security IQ/Tools/Setup-CommvaultAutomation.ps1 x: 9 contributors (all time) y: 222 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_disk.yaml x: 7 contributors (all time) y: 968 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_iface.yaml x: 7 contributors (all time) y: 164 lines of code Solutions/Corelight/Parsers/corelight_files.yaml x: 34 contributors (all time) y: 137 lines of code Solutions/Corelight/Parsers/corelight_http.yaml x: 34 contributors (all time) y: 205 lines of code Solutions/Corelight/Parsers/corelight_intel.yaml x: 27 contributors (all time) y: 101 lines of code Solutions/Corelight/Parsers/corelight_mysql.yaml x: 27 contributors (all time) y: 87 lines of code Solutions/Corelight/Parsers/corelight_notice.yaml x: 27 contributors (all time) y: 146 lines of code Solutions/Corelight/Parsers/corelight_smb_files.yaml x: 27 contributors (all time) y: 125 lines of code Solutions/Corelight/Parsers/corelight_smtp.yaml x: 27 contributors (all time) y: 129 lines of code Solutions/Corelight/Parsers/corelight_software.yaml x: 27 contributors (all time) y: 74 lines of code Solutions/Corelight/Parsers/corelight_suricata_corelight.yaml x: 27 contributors (all time) y: 207 lines of code Solutions/CyberArkAudit/Data Connectors/CyberArkAuditConnector/exporter.py x: 27 contributors (all time) y: 45 lines of code Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml x: 10 contributors (all time) y: 64 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopDetectionsOrchestrator/__init__.py x: 9 contributors (all time) y: 11 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopSentinelActivity/sentinel.py x: 9 contributors (all time) y: 197 lines of code Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml x: 54 contributors (all time) y: 35 lines of code Solutions/Google Apigee/Parsers/Unified_ApigeeX.yaml x: 11 contributors (all time) y: 82 lines of code Solutions/GoogleCloudPlatformDNS/Parsers/GCPCloudDNS.yaml x: 43 contributors (all time) y: 131 lines of code Solutions/IllumioSaaS/Data Connectors/CommonCode/constants.py x: 21 contributors (all time) y: 45 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml x: 65 contributors (all time) y: 81 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml x: 67 contributors (all time) y: 4 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml x: 57 contributors (all time) y: 52 lines of code Solutions/Jamf Protect/Parsers/JamfProtectAlerts.yaml x: 4 contributors (all time) y: 20 lines of code Solutions/Jamf Protect/Parsers/JamfProtectNetworkTraffic.yaml x: 4 contributors (all time) y: 61 lines of code Solutions/Jamf Protect/Parsers/JamfProtectTelemetry.yaml x: 4 contributors (all time) y: 740 lines of code Solutions/Jamf Protect/Parsers/JamfProtectUnifiedLogs.yaml x: 4 contributors (all time) y: 11 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SuspiciousServicePrincipalcreationactivity.yaml x: 48 contributors (all time) y: 97 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/CollectExchSecIns.ps1 x: 14 contributors (all time) y: 3543 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Parsers/ExchangeAdminAuditLogs.yaml x: 61 contributors (all time) y: 65 lines of code Solutions/Mimecast/Analytic Rules/MimecastAudit/Mimecast_Audit.yaml x: 19 contributors (all time) y: 53 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_AV.yaml x: 32 contributors (all time) y: 56 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Attachment.yaml x: 32 contributors (all time) y: 54 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Spam_Event.yaml x: 33 contributors (all time) y: 46 lines of code Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-PasswordSpray.yaml x: 41 contributors (all time) y: 34 lines of code Solutions/SecurityBridge App/Analytical Rules/CriticalEventTriggered.yaml x: 63 contributors (all time) y: 36 lines of code Solutions/SecurityBridge App/Parsers/SecurityBridgeLogs.yaml x: 40 contributors (all time) y: 33 lines of code Solutions/Team Cymru Scout/Parsers/CymruScoutIP.yaml x: 16 contributors (all time) y: 92 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/configurations.py x: 83 contributors (all time) y: 117 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/timer_trigger/__init__.py x: 63 contributors (all time) y: 104 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/timer_trigger_oat/__init__.py x: 87 contributors (all time) y: 105 lines of code DataConnectors/Syslog/Forwarder_AMA_installer.py x: 86 contributors (all time) y: 248 lines of code Solutions/Azure Web Application Firewall (WAF)/Analytic Rules/App-GW-WAF-SQLiDetection.yaml x: 28 contributors (all time) y: 56 lines of code Solutions/Azure Web Application Firewall (WAF)/Analytic Rules/App-GW-WAF-XSSDetection.yaml x: 28 contributors (all time) y: 53 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/main.py x: 24 contributors (all time) y: 147 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/models.py x: 24 contributors (all time) y: 86 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/utils.py x: 30 contributors (all time) y: 276 lines of code Solutions/IPinfo/Data Connectors/ASN/AzureFunctionIPinfoASN/utils.py x: 11 contributors (all time) y: 153 lines of code Solutions/IPinfo/Data Connectors/Domain/AzureFunctionIPinfoDomain/constants.py x: 11 contributors (all time) y: 65 lines of code Solutions/IPinfo/Data Connectors/Iplocation Extended/AzureFunctionIPinfoIplocationExtended/main.py x: 11 contributors (all time) y: 84 lines of code Solutions/IPinfo/Data Connectors/RIRWHOIS/AzureFunctionIPinfoRIRWHOIS/constants.py x: 11 contributors (all time) y: 99 lines of code Solutions/Microsoft 365/Analytic Rules/MailItemsAccessedTimeSeries.yaml x: 75 contributors (all time) y: 80 lines of code Solutions/Microsoft Entra ID/Analytic Rules/NRT_AuthenticationMethodsChangedforVIPUsers.yaml x: 47 contributors (all time) y: 66 lines of code Solutions/ProofPointTap/Analytic Rules/MalwareLinkClicked.yaml x: 104 contributors (all time) y: 52 lines of code Solutions/Proofpoint On demand(POD) Email Security/Data Connectors/ProofpointSentinelConnector/__init__.py x: 61 contributors (all time) y: 165 lines of code Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml x: 52 contributors (all time) y: 52 lines of code DataConnectors/AWS-S3/CloudWatchPushBasedLambdaFunction.py x: 10 contributors (all time) y: 48 lines of code DataConnectors/M365Defender-VulnerabilityManagement/maintenance/deployLatestFunctionPackage.ps1 x: 43 contributors (all time) y: 7 lines of code Detections/MultipleDataSources/AnomalousIPUsageFollowedByTeamsAction.yaml x: 140 contributors (all time) y: 128 lines of code Hunting Queries/AzureStorage/AzureStorageFileCreatedQuicklyDeleted.yaml x: 49 contributors (all time) y: 39 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Attachment/ATP policy status check.yaml x: 37 contributors (all time) y: 27 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Audit Email Preview-Download action.yaml x: 35 contributors (all time) y: 29 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Hunt for TABL changes.yaml x: 35 contributors (all time) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/MDO daily detection summary report.yaml x: 35 contributors (all time) y: 65 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Emails containing links to IP addresses.yaml x: 24 contributors (all time) y: 18 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Good emails from senders with bad patterns.yaml x: 24 contributors (all time) y: 30 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Hunt for email conversation take over attempts.yaml x: 37 contributors (all time) y: 40 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Mailflow/Detections by detection methods.yaml x: 37 contributors (all time) y: 46 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Malware/Email containing malware sent by an internal sender.yaml x: 39 contributors (all time) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Campaign with randomly named attachments.yaml x: 36 contributors (all time) y: 24 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Custom detection-Emails with QR from non-prevalent senders.yaml x: 39 contributors (all time) y: 51 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Emails delivered having URLs from QR codes.yaml x: 38 contributors (all time) y: 25 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Hunting for sender patterns.yaml x: 36 contributors (all time) y: 47 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/QR code/Risky sign-in attempt from a non-managed device.yaml x: 36 contributors (all time) y: 31 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Phishing Email Url Redirector.yaml x: 37 contributors (all time) y: 6 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEvent.yaml x: 104 contributors (all time) y: 63 lines of code Parsers/ASimAuditEvent/Parsers/imAuditEvent.yaml x: 96 contributors (all time) y: 93 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml x: 124 contributors (all time) y: 86 lines of code Parsers/ASimAuthentication/Parsers/imAuthentication.yaml x: 115 contributors (all time) y: 115 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoASA.yaml x: 38 contributors (all time) y: 461 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoASA.yaml x: 34 contributors (all time) y: 590 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async.py x: 91 contributors (all time) y: 193 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async_v2.py x: 23 contributors (all time) y: 230 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/utils.py x: 22 contributors (all time) y: 135 lines of code Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/UserAgentSearch_log4j.yaml x: 96 contributors (all time) y: 101 lines of code Solutions/AristaAwakeSecurity/Analytic Rules/HighMatchCountsByDevice.yaml x: 69 contributors (all time) y: 63 lines of code Solutions/Azure Cloud NGFW by Palo Alto Networks/Analytic Rules/CloudNGFW-PortScanning.yaml x: 44 contributors (all time) y: 60 lines of code Solutions/Azure Cloud NGFW by Palo Alto Networks/Analytic Rules/CloudNGFW-UnusualThreatSignatures.yaml x: 36 contributors (all time) y: 59 lines of code Solutions/BloodHound Enterprise/Data Connectors/handler.go x: 19 contributors (all time) y: 172 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/bloodhound/client.go x: 18 contributors (all time) y: 200 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/connector/main.go x: 18 contributors (all time) y: 597 lines of code Solutions/CTERA/Analytic Rules/InfectedFileDetected.yaml x: 14 contributors (all time) y: 49 lines of code Solutions/CTERA/Analytic Rules/MassAccessDenied.yaml x: 14 contributors (all time) y: 65 lines of code Solutions/CiscoWSA/Analytic Rules/CiscoWSAMultipleErrorsToUnwantedCategory.yaml x: 56 contributors (all time) y: 40 lines of code Solutions/CiscoWSA/Analytic Rules/CiscoWSAMultipleInfectedFiles.yaml x: 59 contributors (all time) y: 36 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicator/CrowdstrikeFalconAPISentinelConnector/__init__.py x: 69 contributors (all time) y: 195 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/QueueTriggerCS/__init__.py x: 64 contributors (all time) y: 284 lines of code Solutions/CyberArkAudit/Data Connectors/CyberArkAuditConnector/audit.py x: 25 contributors (all time) y: 165 lines of code Solutions/CyberArkEPM/DataConnectors/CyberArkEPMSentinelConnector/__init__.py x: 57 contributors (all time) y: 160 lines of code Solutions/Digital Guardian Data Loss Prevention/Analytic Rules/DigitalGuardianClassifiedDataInsecureTransfer.yaml x: 22 contributors (all time) y: 35 lines of code Solutions/Digital Guardian Data Loss Prevention/Hunting Queries/DigitalGuardianDomains.yaml x: 22 contributors (all time) y: 26 lines of code Solutions/Dragos/Analytic Rules/DragosNotifiction.yaml x: 20 contributors (all time) y: 63 lines of code Solutions/Dragos/Parsers/DragosNotificationsToSentinel.yaml x: 20 contributors (all time) y: 18 lines of code Solutions/Dragos/Parsers/DragosPullNotificationsToSentinel.yaml x: 20 contributors (all time) y: 46 lines of code Solutions/Dragos/Parsers/DragosPushNotificationsToSentinel.yaml x: 11 contributors (all time) y: 41 lines of code Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml x: 60 contributors (all time) y: 31 lines of code Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Hunting Queries/Unexpected Countries.yaml x: 60 contributors (all time) y: 27 lines of code Solutions/GitLab/Analytic Rules/GitLab_BruteForce.yaml x: 49 contributors (all time) y: 48 lines of code Solutions/GitLab/Analytic Rules/GitLab_MaliciousIP.yaml x: 75 contributors (all time) y: 49 lines of code Solutions/Global Secure Access/Analytic Rules/Identity - AfterHoursActivity.yaml x: 32 contributors (all time) y: 41 lines of code Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml x: 18 contributors (all time) y: 41 lines of code Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml x: 18 contributors (all time) y: 50 lines of code Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml x: 21 contributors (all time) y: 58 lines of code Solutions/IllumioSaaS/Data Connectors/TimedApiFunctionApp/api_response.py x: 27 contributors (all time) y: 179 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml x: 53 contributors (all time) y: 66 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml x: 95 contributors (all time) y: 67 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml x: 53 contributors (all time) y: 51 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml x: 54 contributors (all time) y: 51 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml x: 54 contributors (all time) y: 79 lines of code Solutions/Infoblox NIOS/Analytic Rules/ExcessiveNXDOMAINDNSQueries.yaml x: 80 contributors (all time) y: 37 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTDenialofService.yaml x: 109 contributors (all time) y: 76 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTExcessiveLoginAttempts.yaml x: 102 contributors (all time) y: 76 lines of code Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTINoSensorTrafficDetected.yaml x: 83 contributors (all time) y: 76 lines of code Solutions/McAfee ePolicy Orchestrator/Analytic Rules/McAfeeEPOAgentHandlerDown.yaml x: 42 contributors (all time) y: 33 lines of code Solutions/McAfee ePolicy Orchestrator/Hunting Queries/McAfeeEPOInfectedFiles.yaml x: 42 contributors (all time) y: 25 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Persistence/LocalAdminGroupChanges.yaml x: 37 contributors (all time) y: 83 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/PossibleWebpBufferOverflow.yaml x: 50 contributors (all time) y: 87 lines of code Solutions/Microsoft Entra ID/Analytic Rules/MFARejectedbyUser.yaml x: 57 contributors (all time) y: 85 lines of code Solutions/NGINX HTTP Server/Analytic Rules/NGINXCommandsInRequest.yaml x: 45 contributors (all time) y: 31 lines of code Solutions/NGINX HTTP Server/Analytic Rules/NGINXPutAndGetFileFromSameIP.yaml x: 45 contributors (all time) y: 44 lines of code Solutions/NGINX HTTP Server/Hunting Queries/NGINXRareFilesRequested.yaml x: 45 contributors (all time) y: 27 lines of code Solutions/Nasuni/Analytic Rules/RansomwareAttackDetected.yaml x: 55 contributors (all time) y: 50 lines of code Solutions/Nasuni/Hunting Queries/FileDeleteEvents.yaml x: 55 contributors (all time) y: 71 lines of code Solutions/Okta Single Sign-On/Analytic Rules/FailedLoginsFromUnknownOrInvalidUser.yaml x: 76 contributors (all time) y: 44 lines of code Solutions/Okta Single Sign-On/Analytic Rules/LoginfromUsersfromDifferentCountrieswithin3hours.yaml x: 76 contributors (all time) y: 37 lines of code Solutions/Oracle Cloud Infrastructure/Data Connectors/AzureFunctionOCILogs/main.py x: 122 contributors (all time) y: 163 lines of code Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml x: 82 contributors (all time) y: 43 lines of code Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml x: 85 contributors (all time) y: 35 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditActionsByIp.yaml x: 46 contributors (all time) y: 35 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditActiveUsers.yaml x: 46 contributors (all time) y: 25 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditDbConnectNonOperationalTime.yaml x: 72 contributors (all time) y: 39 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditUsersNewPrivilegesAdded.yaml x: 73 contributors (all time) y: 33 lines of code Solutions/OracleDatabaseAudit/Hunting Queries/OracleDBAuditUsersPrivilegesReview.yaml x: 63 contributors (all time) y: 26 lines of code Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml x: 69 contributors (all time) y: 30 lines of code Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicPutAndGetFileFromSameIP.yaml x: 56 contributors (all time) y: 44 lines of code Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicPutSuspiciousFiles.yaml x: 60 contributors (all time) y: 43 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicAbnormalRequestSize.yaml x: 34 contributors (all time) y: 32 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicErrors.yaml x: 44 contributors (all time) y: 22 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicFilesErrorRequests.yaml x: 44 contributors (all time) y: 28 lines of code Solutions/OracleWebLogicServer/Hunting Queries/OracleWebLogicRareURLsRequested.yaml x: 34 contributors (all time) y: 25 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-NetworkBeaconing.yaml x: 84 contributors (all time) y: 65 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-PortScanning.yaml x: 89 contributors (all time) y: 65 lines of code Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector/__init__.py x: 81 contributors (all time) y: 239 lines of code Solutions/SentinelOne/Parsers/SentinelOne.yaml x: 43 contributors (all time) y: 651 lines of code Solutions/Symantec Endpoint Protection/Analytic Rules/ExcessiveBlockedTrafficGeneratedbyUser.yaml x: 101 contributors (all time) y: 54 lines of code Solutions/Symantec Endpoint Protection/Analytic Rules/MalwareDetected.yaml x: 103 contributors (all time) y: 39 lines of code Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 x: 111 contributors (all time) y: 292 lines of code Tools/Create-Azure-Sentinel-Solution/common/get-ccp-details.ps1 x: 34 contributors (all time) y: 362 lines of code Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 x: 13 contributors (all time) y: 106 lines of code ASIM/dev/ASimYaml2ARM/KqlFuncYaml2Arm.py x: 59 contributors (all time) y: 219 lines of code ASIM/dev/Parser YAML templates/ASimAlertEventTemplate.yaml x: 15 contributors (all time) y: 30 lines of code ASIM/dev/Parser YAML templates/ASimAuthenticationTemplate.yaml x: 52 contributors (all time) y: 30 lines of code ASIM/dev/Parser YAML templates/vimAlertEventTemplate.yaml x: 15 contributors (all time) y: 82 lines of code ASIM/dev/Parser YAML templates/vimAuditEventTemplate.yaml x: 38 contributors (all time) y: 77 lines of code ASIM/dev/Parser YAML templates/vimAuthenticationTemplate.yaml x: 52 contributors (all time) y: 95 lines of code ASIM/dev/Parser YAML templates/vimDnsTemplate.yaml x: 52 contributors (all time) y: 72 lines of code ASIM/dev/Parser YAML templates/vimProcessEventTemplate.yaml x: 38 contributors (all time) y: 97 lines of code ASIM/dev/Parser YAML templates/vimUserManagementTemplate.yaml x: 38 contributors (all time) y: 62 lines of code ASIM/lib/functions/ASIM_FillNull.yaml x: 12 contributors (all time) y: 26 lines of code DataConnectors/AWS-S3/CloudWatchLambdaFunction.py x: 40 contributors (all time) y: 47 lines of code DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion/__init__.py x: 105 contributors (all time) y: 334 lines of code DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 x: 78 contributors (all time) y: 276 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashEventsBatcher.rb x: 49 contributors (all time) y: 115 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/version.rb x: 71 contributors (all time) y: 9 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec x: 49 contributors (all time) y: 19 lines of code Detections/CommonSecurityLog/MultiVendor-PossibleDGAContacts.yaml x: 111 contributors (all time) y: 132 lines of code Detections/MultipleDataSources/AADHostLoginCorrelation.yaml x: 144 contributors (all time) y: 128 lines of code Detections/MultipleDataSources/powershell_MangoSandstorm.yaml x: 64 contributors (all time) y: 79 lines of code Detections/SecurityAlert/AVSpringShell.yaml x: 79 contributors (all time) y: 5 lines of code Hunting Queries/BehaviorAnalytics/Anomalous AAD Account Manipulation.yaml x: 96 contributors (all time) y: 4 lines of code Hunting Queries/DeviceProcess/VScodeExtensionofanUser.yaml x: 12 contributors (all time) y: 45 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventMicrosoftDefenderXDR.yaml x: 15 contributors (all time) y: 174 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventSentinelOneSingularity.yaml x: 15 contributors (all time) y: 113 lines of code Parsers/ASimAlertEvent/Parsers/vimAlertEventEmpty.yaml x: 15 contributors (all time) y: 129 lines of code Parsers/ASimAlertEvent/Parsers/vimAlertEventMicrosoftDefenderXDR.yaml x: 15 contributors (all time) y: 228 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventIllumioSaaSCore.yaml x: 9 contributors (all time) y: 375 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventInfobloxBloxOne.yaml x: 12 contributors (all time) y: 143 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventIllumioSaaSCore.yaml x: 9 contributors (all time) y: 434 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventInfobloxBloxOne.yaml x: 12 contributors (all time) y: 179 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationMicrosoftWindowsEvent.yaml x: 87 contributors (all time) y: 214 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationIllumioSaaSCore.yaml x: 9 contributors (all time) y: 147 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml x: 86 contributors (all time) y: 396 lines of code Parsers/ASimDhcpEvent/Parsers/ASimDhcpEventInfobloxBloxOne.yaml x: 12 contributors (all time) y: 135 lines of code Parsers/ASimDns/Parsers/ASimDnsInfobloxBloxOne.yaml x: 12 contributors (all time) y: 229 lines of code Parsers/ASimDns/Parsers/imDns.yaml x: 83 contributors (all time) y: 86 lines of code Parsers/ASimDns/Parsers/vimDnsInfobloxBloxOne.yaml x: 12 contributors (all time) y: 285 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml x: 155 contributors (all time) y: 103 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionIllumioSaaSCore.yaml x: 9 contributors (all time) y: 306 lines of code Parsers/ASimNetworkSession/Parsers/imNetworkSession.yaml x: 158 contributors (all time) y: 140 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionIllumioSaaSCore.yaml x: 9 contributors (all time) y: 385 lines of code Playbooks/MDTI-Actor-Lookup/function_app.py x: 17 contributors (all time) y: 104 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/__init__.py x: 71 contributors (all time) y: 143 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_OverlyPermessiveKMS.yaml x: 66 contributors (all time) y: 47 lines of code Solutions/ApacheHTTPServer/Analytic Rules/ApacheRequestToRareFile.yaml x: 59 contributors (all time) y: 42 lines of code Solutions/ApacheHTTPServer/Hunting Queries/ApacheFilesRequested.yaml x: 41 contributors (all time) y: 27 lines of code Solutions/ApacheHTTPServer/Hunting Queries/ApacheRareUAWithClientErrors.yaml x: 59 contributors (all time) y: 26 lines of code Solutions/ApacheHTTPServer/Hunting Queries/ApacheRareURLsRequested.yaml x: 53 contributors (all time) y: 26 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/__init__.py x: 24 contributors (all time) y: 340 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/utils.py x: 26 contributors (all time) y: 205 lines of code Solutions/Armis/Data Connectors/ArmisDevice/Exceptions/ArmisExceptions.py x: 36 contributors (all time) y: 6 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/BreachesDetails/bitsight_breaches.py x: 52 contributors (all time) y: 189 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/CompaniesDetails/bitsight_companies.py x: 52 contributors (all time) y: 248 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/FindingsSummaryDetails/bitsight_findings_summary.py x: 52 contributors (all time) y: 226 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/PortFolioCompanies/bitsight_portfolio.py x: 31 contributors (all time) y: 134 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/SharedCode/bitsight_client.py x: 39 contributors (all time) y: 153 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/SharedCode/utils.py x: 32 contributors (all time) y: 201 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/azure/client.go x: 11 contributors (all time) y: 12 lines of code Solutions/Box/Parsers/BoxEvents.yaml x: 43 contributors (all time) y: 320 lines of code Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml x: 92 contributors (all time) y: 38 lines of code Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml x: 92 contributors (all time) y: 42 lines of code Solutions/Cisco ISE/Analytic Rules/CiscoISECmdExecutionWithHighestPrivilegesNewIP.yaml x: 119 contributors (all time) y: 51 lines of code Solutions/Cisco ISE/Hunting Queries/CiscoISEExpiredCertInClientCertChain.yaml x: 45 contributors (all time) y: 13 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGDroppedInMails.yaml x: 56 contributors (all time) y: 25 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGDroppedOutMails.yaml x: 55 contributors (all time) y: 25 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGInsecureProtocol.yaml x: 69 contributors (all time) y: 25 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGSpamMails.yaml x: 71 contributors (all time) y: 27 lines of code Solutions/CiscoSEG/Hunting Queries/CiscoSEGUsersReceivedSpam.yaml x: 87 contributors (all time) y: 27 lines of code Solutions/CiscoSEG/Parsers/CiscoSEGEvent.yaml x: 38 contributors (all time) y: 47 lines of code Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml x: 91 contributors (all time) y: 44 lines of code Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml x: 91 contributors (all time) y: 37 lines of code Solutions/Cloudflare/Data Connectors/AzureFunctionCloudflare/main.py x: 153 contributors (all time) y: 160 lines of code Solutions/Cloudflare/Data Connectors/AzureFunctionCloudflare/sentinel_connector_async.py x: 60 contributors (all time) y: 94 lines of code Solutions/CohesitySecurity/Data Connectors/Helios2Sentinel/IncidentProducer/IncidentProducer.cs x: 59 contributors (all time) y: 376 lines of code Solutions/Corelight/Parsers/corelight_conn.yaml x: 30 contributors (all time) y: 198 lines of code Solutions/Corelight/Parsers/corelight_dns.yaml x: 30 contributors (all time) y: 167 lines of code Solutions/Corelight/Parsers/corelight_etc_viz.yaml x: 30 contributors (all time) y: 111 lines of code Solutions/Corelight/Parsers/corelight_rdp.yaml x: 30 contributors (all time) y: 117 lines of code Solutions/Corelight/Parsers/corelight_vpn.yaml x: 30 contributors (all time) y: 177 lines of code Solutions/Cortex XDR/Parsers/PaloAltoCortexXDR.yaml x: 9 contributors (all time) y: 41 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml x: 136 contributors (all time) y: 19 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml x: 136 contributors (all time) y: 45 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/Replicator/main_aws_queue.py x: 67 contributors (all time) y: 157 lines of code Solutions/DNS Essentials/Analytic Rules/MultipleErrorsReportedForSameDNSQueryStaticThresholdBased.yaml x: 68 contributors (all time) y: 74 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/DomainRiskScore/__init__.py x: 24 contributors (all time) y: 70 lines of code Solutions/ESET Protect Platform/Data Connectors/function_app.py x: 15 contributors (all time) y: 17 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/__init__.py x: 14 contributors (all time) y: 1 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/models_detections.py x: 18 contributors (all time) y: 96 lines of code Solutions/FalconFriday/Analytic Rules/MatchLegitimateNameOrLocation.yaml x: 55 contributors (all time) y: 62 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml x: 23 contributors (all time) y: 94 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml x: 23 contributors (all time) y: 76 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml x: 23 contributors (all time) y: 58 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml x: 23 contributors (all time) y: 116 lines of code Solutions/Global Secure Access/Analytic Rules/Office 365 - office_policytampering.yaml x: 23 contributors (all time) y: 100 lines of code Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml x: 26 contributors (all time) y: 110 lines of code Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml x: 19 contributors (all time) y: 15 lines of code Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml x: 19 contributors (all time) y: 73 lines of code Solutions/IllumioSaaS/Data Connectors/CommonCode/sentinel_connector.py x: 9 contributors (all time) y: 48 lines of code Solutions/IllumioSaaS/Data Connectors/QueueTriggerFuncApp/azure_queue_trigger.py x: 26 contributors (all time) y: 161 lines of code Solutions/IllumioSaaS/Data Connectors/TimedSQSFunctionApp/aws_queue.py x: 26 contributors (all time) y: 250 lines of code Solutions/Malware Protection Essentials/Analytic Rules/SuspiciousProcessCreation.yaml x: 29 contributors (all time) y: 95 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Bulk record ownership re-assignment or sharing.yaml x: 9 contributors (all time) y: 72 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Guest user exfiltration following Power Platform defense impairment.yaml x: 9 contributors (all time) y: 126 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Hierarchy security manipulation.yaml x: 9 contributors (all time) y: 99 lines of code Solutions/Microsoft Business Applications/Parsers/MSBizAppsOrgSettings.yaml x: 9 contributors (all time) y: 478 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/Hunting/Automated email notifications and suspicious sign-in activity.yaml x: 16 contributors (all time) y: 26 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml x: 16 contributors (all time) y: 30 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Parsers/MESCompareDataOnPMRA.yaml x: 15 contributors (all time) y: 183 lines of code Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml x: 31 contributors (all time) y: 187 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/PerformanceDetails/mimecast_performance_details_to_sentinel.py x: 11 contributors (all time) y: 216 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/sentinel.py x: 12 contributors (all time) y: 249 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/utils.py x: 11 contributors (all time) y: 751 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/UserData/mimecast_user_data_to_sentinel.py x: 11 contributors (all time) y: 233 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/MimecastAudit/mimecast_audit_to_sentinel.py x: 12 contributors (all time) y: 474 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/sentinel.py x: 12 contributors (all time) y: 256 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/utils.py x: 11 contributors (all time) y: 565 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/MimecastCI/mimecast_ci_to_sentinel.py x: 11 contributors (all time) y: 553 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/sentinel.py x: 12 contributors (all time) y: 318 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/utils.py x: 11 contributors (all time) y: 628 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/MimecastDLP/mimecast_dlp_to_sentinel.py x: 11 contributors (all time) y: 342 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/SharedCode/sentinel.py x: 12 contributors (all time) y: 386 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/SharedCode/utils.py x: 11 contributors (all time) y: 625 lines of code Solutions/Mimecast/Data Connectors/MimecastTTP/SharedCode/utils.py x: 11 contributors (all time) y: 733 lines of code Solutions/Mimecast/Parsers/MimecastSEG/Mimecast_SEG_CG.yaml x: 11 contributors (all time) y: 195 lines of code Solutions/Okta Single Sign-On/Analytic Rules/NewDeviceLocationCriticalOperation.yaml x: 62 contributors (all time) y: 61 lines of code Solutions/Okta Single Sign-On/Parsers/OktaSSO.yaml x: 49 contributors (all time) y: 157 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/FileHashEntity_Covid19_CommonSecurityLog.yaml x: 80 contributors (all time) y: 70 lines of code Solutions/PaloAlto-PAN-OS/Analytic Rules/PaloAlto-UnusualThreatSignatures.yaml x: 70 contributors (all time) y: 57 lines of code Solutions/PaloAlto-PAN-OS/Hunting Queries/Palo Alto - potential beaconing detected.yaml x: 72 contributors (all time) y: 61 lines of code Solutions/PaloAlto-PAN-OS/Hunting Queries/PaloAlto-HighRiskPorts.yaml x: 70 contributors (all time) y: 112 lines of code Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLConflictingMacAddress.yaml x: 77 contributors (all time) y: 39 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLCriticalEventResult.yaml x: 58 contributors (all time) y: 28 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLFilePermissionWithPutRequest.yaml x: 58 contributors (all time) y: 26 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLOutdatedConfigVersions.yaml x: 77 contributors (all time) y: 27 lines of code Solutions/PaloAltoCDL/Hunting Queries/PaloAltoCDLRarePortsbyUser.yaml x: 67 contributors (all time) y: 30 lines of code Solutions/PingFederate/Analytic Rules/PingFederateAbnormalPasswordResetsAttempts.yaml x: 99 contributors (all time) y: 32 lines of code Solutions/PingFederate/Analytic Rules/PingFederateAuthFromNewSource.yaml x: 99 contributors (all time) y: 42 lines of code Solutions/PingFederate/Hunting Queries/PingFederateAuthUrls.yaml x: 67 contributors (all time) y: 25 lines of code Solutions/PingFederate/Hunting Queries/PingFederateUnusualSources.yaml x: 84 contributors (all time) y: 29 lines of code Solutions/Pure Storage/Analytic Rules/FB-FabricModuleUnhealthy.yaml x: 15 contributors (all time) y: 44 lines of code Solutions/RubrikSecurityCloud/Data Connectors/RubrikWebhookEvents/shared_code/consts.py x: 38 contributors (all time) y: 10 lines of code Solutions/SonicWall Firewall/Analytic Rules/CaptureATPMaliciousFileDetection.yaml x: 31 contributors (all time) y: 60 lines of code Solutions/SonicWall Firewall/Hunting Queries/OutboundSSHConnections.yaml x: 31 contributors (all time) y: 34 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/DomainDataCollector/domain_collector.py x: 14 contributors (all time) y: 87 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/IPDataCollector/ip_collector.py x: 14 contributors (all time) y: 252 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/SharedCode/sentinel.py x: 14 contributors (all time) y: 197 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/SharedCode/teamcymruscout_client.py x: 14 contributors (all time) y: 173 lines of code Solutions/Team Cymru Scout/Data Connectors/TeamCymruScout/SharedCode/utils.py x: 14 contributors (all time) y: 147 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableCleanTables/__init__.py x: 29 contributors (all time) y: 41 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableCleanUpOrchestrator/__init__.py x: 29 contributors (all time) y: 13 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableComplianceExportOrchestrator/__init__.py x: 15 contributors (all time) y: 87 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableExportStarter/__init__.py x: 29 contributors (all time) y: 134 lines of code Solutions/Tenable App/Data Connectors/TenableVM/TenableExportsOrchestrator/__init__.py x: 29 contributors (all time) y: 176 lines of code Solutions/Tenable App/Data Connectors/TenableVM/azure_sentinel.py x: 29 contributors (all time) y: 58 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml x: 50 contributors (all time) y: 74 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_CloudAppEvents.yaml x: 32 contributors (all time) y: 4 lines of code Solutions/Tomcat/Analytic Rules/TomcatCommandsinRequest.yaml x: 51 contributors (all time) y: 31 lines of code Solutions/Tomcat/Analytic Rules/TomcatPutAndGetFileFromSameIP.yaml x: 51 contributors (all time) y: 44 lines of code Solutions/TransmitSecurity/Data Connectors/TransmitSecurityConnector/__init__.py x: 24 contributors (all time) y: 126 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneChannelType.yaml x: 67 contributors (all time) y: 75 lines of code Solutions/Trend Micro Apex One/Hunting Queries/TMApexOneRareAppProtocolByIP.yaml x: 75 contributors (all time) y: 148 lines of code Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiL2RFTP.yaml x: 55 contributors (all time) y: 36 lines of code Solutions/Ubiquiti UniFi/Analytic Rules/UbiquitiL2RLargeIcmp.yaml x: 46 contributors (all time) y: 43 lines of code Solutions/VMWareESXi/Analytic Rules/ESXiDormantVMStarted.yaml x: 94 contributors (all time) y: 57 lines of code Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml x: 98 contributors (all time) y: 46 lines of code Solutions/VMware vCenter/Analytic Rules/vCenterRootLogin.yaml x: 50 contributors (all time) y: 37 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Account-Detections.yaml x: 66 contributors (all time) y: 94 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Account-by-Severity.yaml x: 90 contributors (all time) y: 37 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-HighSeverityDetection-by-Tactics.yaml x: 90 contributors (all time) y: 114 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Host-by-Severity.yaml x: 90 contributors (all time) y: 87 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml x: 100 contributors (all time) y: 62 lines of code Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Suspected-Behavior-by-Tactics.yaml x: 90 contributors (all time) y: 100 lines of code Solutions/Vectra AI Stream/Parsers/vectra_match.yaml x: 10 contributors (all time) y: 17 lines of code Solutions/Vectra AI Stream/Parsers/vectra_stream.yaml x: 25 contributors (all time) y: 13 lines of code Solutions/ZeroNetworks/Parsers/ZNSegmentAudit.yaml x: 41 contributors (all time) y: 208 lines of code Solutions/Zscaler Internet Access/Analytic Rules/Zscaler-LowVolumeDomainRequests.yaml x: 69 contributors (all time) y: 53 lines of code Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsFromNewIP.yaml x: 63 contributors (all time) y: 43 lines of code Solutions/Zscaler Private Access (ZPA)/Hunting Queries/ZscalerIPsByPorts.yaml x: 62 contributors (all time) y: 24 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logAnalyticsClient.rb x: 65 contributors (all time) y: 102 lines of code Detections/CommonSecurityLog/TimeSeriesAnomaly-MultiVendor_NetworkTraffic.yaml x: 111 contributors (all time) y: 92 lines of code Detections/MultipleDataSources/StarBlizzardDomainsAugust2022.yaml x: 60 contributors (all time) y: 117 lines of code Detections/SecurityEvent/RDP_Nesting.yaml x: 141 contributors (all time) y: 159 lines of code Detections/SigninLogs/ExplicitMFADeny.yaml x: 136 contributors (all time) y: 5 lines of code Detections/ZoomLogs/SupiciousLinkSharing.yaml x: 122 contributors (all time) y: 46 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventBarracudaCEF.yaml x: 13 contributors (all time) y: 160 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventBarracudaWAF.yaml x: 43 contributors (all time) y: 159 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCiscoMeraki.yaml x: 39 contributors (all time) y: 219 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCiscoMerakiSyslog.yaml x: 14 contributors (all time) y: 225 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventMicrosoftEvent.yaml x: 13 contributors (all time) y: 184 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventMicrosoftSecurityEvents.yaml x: 13 contributors (all time) y: 201 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventMicrosoftWindowsEvents.yaml x: 85 contributors (all time) y: 196 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventBarracudaWAF.yaml x: 43 contributors (all time) y: 205 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventCiscoMeraki.yaml x: 39 contributors (all time) y: 257 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftEvent.yaml x: 13 contributors (all time) y: 260 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftSecurityEvents.yaml x: 13 contributors (all time) y: 288 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftWindowsEvents.yaml x: 85 contributors (all time) y: 282 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoMeraki.yaml x: 48 contributors (all time) y: 146 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoMerakiSyslog.yaml x: 14 contributors (all time) y: 155 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationOktaOSS.yaml x: 101 contributors (all time) y: 113 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoMeraki.yaml x: 51 contributors (all time) y: 224 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationOktaOSS.yaml x: 95 contributors (all time) y: 189 lines of code Parsers/ASimDns/Parsers/ASimDnsMicrosoftSysmon.yaml x: 74 contributors (all time) y: 118 lines of code Parsers/ASimDns/Parsers/vimDnsMicrosoftSysmon.yaml x: 54 contributors (all time) y: 180 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEvent.yaml x: 58 contributors (all time) y: 64 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftSysmon.yaml x: 34 contributors (all time) y: 104 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftSysmonWindowsEvent.yaml x: 13 contributors (all time) y: 96 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftWindowsEvents.yaml x: 34 contributors (all time) y: 91 lines of code Parsers/ASimFileEvent/Parsers/imFileEvent.yaml x: 84 contributors (all time) y: 109 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventMicrosoftSysmon.yaml x: 51 contributors (all time) y: 178 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventMicrosoftSysmonWindowsEvent.yaml x: 13 contributors (all time) y: 169 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionBarracudaWAF.yaml x: 42 contributors (all time) y: 132 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoMeraki.yaml x: 85 contributors (all time) y: 382 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoMerakiSyslog.yaml x: 14 contributors (all time) y: 386 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml x: 44 contributors (all time) y: 126 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmonWindowsEvent.yaml x: 12 contributors (all time) y: 121 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftWindowsEventFirewall.yaml x: 99 contributors (all time) y: 135 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionBarracudaWAF.yaml x: 42 contributors (all time) y: 204 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoMeraki.yaml x: 85 contributors (all time) y: 450 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoMerakiSyslog.yaml x: 14 contributors (all time) y: 454 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSecurityEventFirewall.yaml x: 15 contributors (all time) y: 295 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSysmon.yaml x: 12 contributors (all time) y: 204 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSysmonWindowsEvent.yaml x: 12 contributors (all time) y: 195 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftWindowsEventFirewall.yaml x: 109 contributors (all time) y: 196 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessCreateMicrosoftSysmon.yaml x: 60 contributors (all time) y: 131 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessCreateMicrosoftSysmonWindowsEvent.yaml x: 13 contributors (all time) y: 114 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessEvent.yaml x: 88 contributors (all time) y: 59 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessTerminateMicrosoftSysmon.yaml x: 60 contributors (all time) y: 83 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessTerminateMicrosoftSysmonWindowsEvent.yaml x: 12 contributors (all time) y: 59 lines of code Parsers/ASimProcessEvent/Parsers/imProcessEvent.yaml x: 58 contributors (all time) y: 106 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftSysmon.yaml x: 71 contributors (all time) y: 215 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMicrosoftSysmon.yaml x: 72 contributors (all time) y: 146 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMicrosoftSysmonWindowsEvent.yaml x: 12 contributors (all time) y: 161 lines of code Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventMicrosoftSysmon.yaml x: 34 contributors (all time) y: 141 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoftSecurityEvent.yaml x: 28 contributors (all time) y: 172 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoftSysmon.yaml x: 63 contributors (all time) y: 173 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoftWindowsEvent.yaml x: 82 contributors (all time) y: 176 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagement.yaml x: 47 contributors (all time) y: 51 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementMicrosoftSecurityEvent.yaml x: 45 contributors (all time) y: 257 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementMicrosoftWindowsEvent.yaml x: 13 contributors (all time) y: 243 lines of code Parsers/ASimWebSession/Parsers/ASimWebSession.yaml x: 144 contributors (all time) y: 64 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionBarracudaWAF.yaml x: 42 contributors (all time) y: 195 lines of code Parsers/ASimWebSession/Parsers/imWebSession.yaml x: 143 contributors (all time) y: 105 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionBarracudaWAF.yaml x: 42 contributors (all time) y: 262 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/sentinel.py x: 17 contributors (all time) y: 150 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/Exceptions/ArmisExceptions.py x: 18 contributors (all time) y: 4 lines of code Solutions/CiscoMeraki/Parsers/CiscoMeraki.yaml x: 50 contributors (all time) y: 246 lines of code Solutions/DNS Essentials/Hunting Queries/AnomalousIncreaseInDNSActivityByClients.yaml x: 51 contributors (all time) y: 119 lines of code Solutions/DNS Essentials/Hunting Queries/DNSQueryWithFailuresInLast24Hours.yaml x: 51 contributors (all time) y: 26 lines of code Solutions/DNS Essentials/Hunting Queries/IncreaseInDNSRequestsByClientThanTheDailyAverageCount.yaml x: 51 contributors (all time) y: 63 lines of code Solutions/DomainTools/Parsers/DomainToolsDNS.yaml x: 17 contributors (all time) y: 37 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/ClassicReverseIP/__init__.py x: 16 contributors (all time) y: 74 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/DomainSearch/__init__.py x: 16 contributors (all time) y: 113 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/EnrichDomain/__init__.py x: 16 contributors (all time) y: 306 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/InvestigateDomain/__init__.py x: 16 contributors (all time) y: 458 lines of code Solutions/DomainTools/Playbooks/CustomConnector/DomainTools_FunctionAppConnector/ParsedWhois/__init__.py x: 16 contributors (all time) y: 111 lines of code Solutions/ESETPROTECT/Analytic Rules/ESETThreatDetected.yaml x: 90 contributors (all time) y: 45 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/FetchAndSendDetections/__init__.py x: 28 contributors (all time) y: 86 lines of code Solutions/Fortinet FortiNDR Cloud/Parsers/Fortinet_FortiNDR_Cloud.yaml x: 38 contributors (all time) y: 357 lines of code Solutions/Global Secure Access/Hunting Queries/ExternalUserAddedRemovedInTeams_HuntVersion.yaml x: 16 contributors (all time) y: 42 lines of code Solutions/Illusive Platform/Analytic Rules/Illusive_Detection_Query.yaml x: 63 contributors (all time) y: 67 lines of code Solutions/Infoblox NIOS/Parsers/Infoblox_dhcpoffer.yaml x: 39 contributors (all time) y: 29 lines of code Solutions/Infoblox NIOS/Parsers/Infoblox_dnsclient.yaml x: 39 contributors (all time) y: 67 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/AzureStorageToIndicators/create_indicator.py x: 16 contributors (all time) y: 167 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/AzureStorageToIndicators/indicator_mapping.py x: 16 contributors (all time) y: 149 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxCurrentToAzureStorage/infoblox_to_azure_storage.py x: 16 contributors (all time) y: 519 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxDossierHttpStarter/__init__.py x: 16 contributors (all time) y: 65 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxDossierJobResult/get_dossier_result.py x: 16 contributors (all time) y: 170 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxHistoricalToAzureStorage/infoblox_to_azure_storage.py x: 16 contributors (all time) y: 538 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxParseRawIndicators/parse_json_files.py x: 16 contributors (all time) y: 372 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/RetryFailedIndicators/__init__.py x: 16 contributors (all time) y: 13 lines of code Solutions/Infoblox/Data Connectors/InfobloxCloudDataConnector/SharedCode/utils.py x: 16 contributors (all time) y: 948 lines of code Solutions/MicrosoftDefenderForEndpoint/Analytic Rules/AquaBlizzardAVHits.yaml x: 48 contributors (all time) y: 58 lines of code Solutions/SonraiSecurity/Analytic Rules/SonraiTicketRiskAccepted.yaml x: 73 contributors (all time) y: 5 lines of code Solutions/Sophos XG Firewall/Parsers/SophosXGFirewall.yaml x: 42 contributors (all time) y: 77 lines of code Solutions/Symantec Endpoint Protection/Parsers/SymantecEndpointProtection.yaml x: 46 contributors (all time) y: 186 lines of code Solutions/Syslog/Analytic Rules/squid_tor_proxies.yaml x: 59 contributors (all time) y: 62 lines of code Solutions/Theom/Analytic Rules/TheomRisksCritical.yaml x: 54 contributors (all time) y: 58 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CloudAppEvents.yaml x: 34 contributors (all time) y: 48 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_AuditLogs.yaml x: 105 contributors (all time) y: 77 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_CloudAppEvents.yaml x: 35 contributors (all time) y: 4 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_OfficeActivity.yaml x: 107 contributors (all time) y: 53 lines of code Solutions/UEBA Essentials/Hunting Queries/Anomalous Sign-in Activity.yaml x: 82 contributors (all time) y: 8 lines of code Solutions/Vectra XDR/Data Connectors/VectraDataConnector/SharedCode/collector.py x: 52 contributors (all time) y: 1099 lines of code Solutions/Vectra XDR/Data Connectors/VectraDataConnector/SharedCode/consts.py x: 52 contributors (all time) y: 65 lines of code Solutions/Vectra XDR/Parsers/VectraDetections.yaml x: 40 contributors (all time) y: 71 lines of code Solutions/Vectra XDR/Parsers/VectraEntityScoring.yaml x: 40 contributors (all time) y: 59 lines of code Solutions/ZeroFox/Data Connectors/CTI/AzureFunctionZeroFoxCTI/advanced_dark_web_connector/__init__.py x: 24 contributors (all time) y: 54 lines of code Solutions/ZeroFox/Data Connectors/CTI/AzureFunctionZeroFoxCTI/botnet_compromised_credentials_connector/__init__.py x: 24 contributors (all time) y: 56 lines of code Solutions/iboss/Parsers/ibossUrlEvent.yaml x: 42 contributors (all time) y: 42 lines of code Tools/AzureDataExplorer/CreateTables_ADX_ScriptFile/Create-LA-Tables-ADX-ScriptFile.ps1 x: 14 contributors (all time) y: 392 lines of code Tools/Copy-AzOperationalInsightsTable/Copy-AzOperationalInsightsTable.ps1 x: 14 contributors (all time) y: 123 lines of code Tools/Create-Azure-Sentinel-Solution/pipeline/createSolutionV4.ps1 x: 91 contributors (all time) y: 305 lines of code Tools/Sentinel-All-In-One/v2/Scripts/Create-NewSolutionAndRulesFromList.ps1 x: 79 contributors (all time) y: 187 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationBarracudaWAF.yaml x: 35 contributors (all time) y: 215 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationBarracudaWAF.yaml x: 45 contributors (all time) y: 315 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionCiscoMeraki.yaml x: 30 contributors (all time) y: 186 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionCiscoMeraki.yaml x: 30 contributors (all time) y: 248 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/models/workbench.py x: 28 contributors (all time) y: 36 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/services/workbench_service.py x: 84 contributors (all time) y: 219 lines of code Solutions/Microsoft 365/Analytic Rules/External User added to Team and immediately uploads file.yaml x: 67 contributors (all time) y: 88 lines of code DataConnectors/M365Defender-VulnerabilityManagement/functionPackage/GetMDVMData/run.ps1 x: 57 contributors (all time) y: 243 lines of code DataConnectors/M365Defender-VulnerabilityManagement/functionPackage/requirements.psd1 x: 46 contributors (all time) y: 10 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin.rb x: 60 contributors (all time) y: 56 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logstashLoganalyticsConfiguration.rb x: 60 contributors (all time) y: 193 lines of code Detections/ASimAuthentication/imAuthSigninsMultipleCountries.yaml x: 115 contributors (all time) y: 69 lines of code Detections/ASimProcess/imProcess_SolarWinds_SUNBURST_Process-IOCs.yaml x: 95 contributors (all time) y: 34 lines of code Detections/ASimWebSession/UnusualUACryptoMiners.yaml x: 88 contributors (all time) y: 71 lines of code Detections/ASimWebSession/UnusualUAHackTool.yaml x: 99 contributors (all time) y: 82 lines of code Detections/Heartbeat/OMI_vulnerability_detection.yaml x: 87 contributors (all time) y: 56 lines of code Detections/MultipleDataSources/RiskyUserIn3Pnetworkactivity.yaml x: 79 contributors (all time) y: 98 lines of code Detections/MultipleDataSources/SecurityServiceRegistryACLModification.yaml x: 116 contributors (all time) y: 142 lines of code Detections/SigninLogs/AnomalousSingleFactorSignin.yaml x: 22 contributors (all time) y: 73 lines of code Solutions/1Password/Analytics Rules/1Password - Changes to firewall rules.yaml x: 23 contributors (all time) y: 51 lines of code Solutions/1Password/Data Connectors/Modules/HelperFunctions/HelperFunctions.psm1 x: 21 contributors (all time) y: 351 lines of code Solutions/1Password/Data Connectors/profile.ps1 x: 21 contributors (all time) y: 19 lines of code Solutions/1Password/Data Connectors/requirements.psd1 x: 21 contributors (all time) y: 9 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_FullAdminPolicyAttachedToRolesUsersGroups.yaml x: 86 contributors (all time) y: 87 lines of code Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/Log4J_IPIOC_Dec112021.yaml x: 79 contributors (all time) y: 219 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Deny Rate for Source IP.yaml x: 81 contributors (all time) y: 86 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Abnormal Port to Protocol.yaml x: 76 contributors (all time) y: 82 lines of code Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Multiple Sources Affected by the Same TI Destination.yaml x: 84 contributors (all time) y: 51 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaConnectionToUnpopularWebsiteDetected.yaml x: 94 contributors (all time) y: 44 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml x: 94 contributors (all time) y: 39 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaHackToolUserAgentDetected.yaml x: 94 contributors (all time) y: 93 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaRequestAllowedHarmfulMaliciousURICategory.yaml x: 86 contributors (all time) y: 54 lines of code Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaURIContainsIPAddress.yaml x: 86 contributors (all time) y: 37 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/Signins-From-VPS-Providers.yaml x: 97 contributors (all time) y: 8 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/CofenseBasedIndicatorCreator/cofense_to_sentinel_mapping.py x: 62 contributors (all time) y: 323 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/CofenseBasedIndicatorCreator/sentinel.py x: 62 contributors (all time) y: 193 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/RetryFailedIndicators/retry_failed_indicators.py x: 18 contributors (all time) y: 270 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/RetryFailedIndicators/sentinel.py x: 18 contributors (all time) y: 193 lines of code Solutions/Cyware/Hunting queries/MatchCywareIntelWatchlistItemsWithCommonLogs.yaml x: 18 contributors (all time) y: 20 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/DumpingLSASSProcessIntoaFile.yaml x: 64 contributors (all time) y: 48 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml x: 65 contributors (all time) y: 49 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/malware_in_recyclebin.yaml x: 69 contributors (all time) y: 71 lines of code Solutions/Endpoint Threat Protection Essentials/Hunting Queries/RemoteScheduledTaskCreationUpdateUsingATSVCNamedPipe.yaml x: 68 contributors (all time) y: 49 lines of code Solutions/FalconFriday/Analytic Rules/ExcessiveSharePermissions.yaml x: 51 contributors (all time) y: 95 lines of code Solutions/Forescout (Legacy)/Parsers/ForescoutEvent.yaml x: 17 contributors (all time) y: 23 lines of code Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_OfficeActivity.yaml x: 32 contributors (all time) y: 80 lines of code Solutions/GreyNoiseThreatIntelligence/Analytic Rules/GreyNoise_IPEntity_imNetworkSession.yaml x: 40 contributors (all time) y: 130 lines of code Solutions/IPinfo/Data Connectors/Company/AzureFunctionIPinfoCompany/constants.py x: 18 contributors (all time) y: 77 lines of code Solutions/IPinfo/Data Connectors/Company/AzureFunctionIPinfoCompany/utils.py x: 18 contributors (all time) y: 153 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/PossiblePhishingwithCSL&NetworkSession.yaml x: 44 contributors (all time) y: 147 lines of code Solutions/Microsoft Entra ID/Analytic Rules/ADFSDomainTrustMods.yaml x: 45 contributors (all time) y: 91 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AccountCreatedDeletedByNonApprovedUser.yaml x: 43 contributors (all time) y: 61 lines of code Solutions/Microsoft Entra ID/Analytic Rules/CredentialAddedAfterAdminConsent.yaml x: 40 contributors (all time) y: 153 lines of code Solutions/Microsoft Entra ID/Analytic Rules/NRT_ADFSDomainTrustMods.yaml x: 46 contributors (all time) y: 72 lines of code Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingDomainAllActors.yaml x: 41 contributors (all time) y: 65 lines of code Solutions/SlackAudit/Analytic Rules/SlackAuditUnknownUA.yaml x: 89 contributors (all time) y: 34 lines of code Solutions/Syslog/Workspace Functions/SyslogConnectorsEventVolumebyDeviceProduct.yaml x: 17 contributors (all time) y: 56 lines of code Solutions/Tenable App/Parsers/TenableVMAssets.yaml x: 18 contributors (all time) y: 129 lines of code Solutions/Tenable App/Parsers/TenableVMVulnerabilities.yaml x: 18 contributors (all time) y: 220 lines of code Solutions/Tenable App/Parsers/afad_parser.yaml x: 18 contributors (all time) y: 117 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_DnsEvents.yaml x: 106 contributors (all time) y: 89 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailEvents.yaml x: 46 contributors (all time) y: 59 lines of code Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml x: 107 contributors (all time) y: 79 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_AzureActivity.yaml x: 100 contributors (all time) y: 70 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_PaloAlto.yaml x: 92 contributors (all time) y: 67 lines of code Solutions/Threat Intelligence/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 93 contributors (all time) y: 91 lines of code Solutions/Threat Intelligence/Analytic Rules/FileHashEntity_CommonSecurityLog.yaml x: 99 contributors (all time) y: 85 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AppServiceHTTPLogs.yaml x: 107 contributors (all time) y: 92 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AzureActivity.yaml x: 112 contributors (all time) y: 86 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_AzureKeyVault.yaml x: 103 contributors (all time) y: 70 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_DeviceNetworkEvents.yaml x: 37 contributors (all time) y: 69 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_DuoSecurity.yaml x: 97 contributors (all time) y: 54 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_SigninLogs.yaml x: 71 contributors (all time) y: 75 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_imNetworkSession.yaml x: 78 contributors (all time) y: 122 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_DeviceNetworkEvents.yaml x: 43 contributors (all time) y: 73 lines of code Solutions/Threat Intelligence/Analytic Rules/URLEntity_SecurityAlerts.yaml x: 94 contributors (all time) y: 71 lines of code Solutions/ThreatConnect/Analytic Rules/ThreatConnect_DomainEntity_DnsEvents.yaml x: 40 contributors (all time) y: 92 lines of code Solutions/ThreatConnect/Analytic Rules/ThreatConnect_EmailEntity_SigninLogs.yaml x: 35 contributors (all time) y: 83 lines of code Solutions/ThreatConnect/Analytic Rules/ThreatConnect_IPEntity_NetworkSessions.yaml x: 41 contributors (all time) y: 80 lines of code Solutions/ThreatConnect/Analytic Rules/ThreatConnect_URLEntity_OfficeActivity.yaml x: 35 contributors (all time) y: 54 lines of code Solutions/Trend Micro Vision One/Analytic Rules/Create Incident for XDR Alerts.yaml x: 61 contributors (all time) y: 89 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/queue_trigger_rca/__init__.py x: 49 contributors (all time) y: 63 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/queue_trigger_wb/__init__.py x: 69 contributors (all time) y: 113 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/transform_utils.py x: 71 contributors (all time) y: 293 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/DatAlert/DatAlertClient.cs x: 31 contributors (all time) y: 143 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/DatAlert/DatAlertParams.cs x: 31 contributors (all time) y: 13 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Helpers/CustomParser.cs x: 32 contributors (all time) y: 25 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Helpers/SearchAlertObjectMapper.cs x: 32 contributors (all time) y: 104 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Search/AlertSearchQueryBuilder.cs x: 32 contributors (all time) y: 158 lines of code Solutions/VaronisSaaS/Data Connectors/VaronisSaaSFunction/Varonis.Sentinel.Functions/Search/Model/AlertAttributes.cs x: 32 contributors (all time) y: 86 lines of code DataConnectors/AWS-S3/Enviornment/EnviornmentConstants.ps1 x: 40 contributors (all time) y: 20 lines of code Detections/ASimAuthentication/imAuthBruteForce.yaml x: 111 contributors (all time) y: 75 lines of code Detections/ASimDNS/imDns_HighNXDomainCount_detection.yaml x: 97 contributors (all time) y: 83 lines of code Detections/ASimWebSession/PossibleDGAContacts.yaml x: 110 contributors (all time) y: 57 lines of code Detections/AzureActivity/RareRunCommandPowerShellScript.yaml x: 127 contributors (all time) y: 80 lines of code Detections/CommonSecurityLog/Fortinet-NetworkBeaconPattern.yaml x: 110 contributors (all time) y: 85 lines of code Detections/LAQueryLogs/UserSearchingForVIPUserActivity.yaml x: 117 contributors (all time) y: 50 lines of code Detections/MultipleDataSources/AAD_PAVPN_Correlation.yaml x: 115 contributors (all time) y: 86 lines of code Detections/MultipleDataSources/B64IPInURLFromMDE.yaml x: 51 contributors (all time) y: 72 lines of code Detections/MultipleDataSources/ExchangeWorkerProcessMakingRemoteCall.yaml x: 81 contributors (all time) y: 70 lines of code Detections/MultipleDataSources/MalformedUserAgents.yaml x: 144 contributors (all time) y: 109 lines of code Detections/MultipleDataSources/MultiplePasswordresetsbyUser.yaml x: 152 contributors (all time) y: 136 lines of code Detections/MultipleDataSources/PrestigeRansomwareIOCsOct22.yaml x: 85 contributors (all time) y: 124 lines of code Detections/MultipleDataSources/RunCommandUEBABreach.yaml x: 129 contributors (all time) y: 79 lines of code Detections/MultipleDataSources/SigninFirewallCorrelation.yaml x: 140 contributors (all time) y: 67 lines of code Detections/MultipleDataSources/SuspiciousVMInstanceCreationActivity.yaml x: 55 contributors (all time) y: 141 lines of code Detections/MultipleDataSources/TimeSeriesAnomaly-MultiVendor_DataExfiltration.yaml x: 139 contributors (all time) y: 123 lines of code Detections/SecurityAlert/HiveRansomwareAVHits.yaml x: 85 contributors (all time) y: 59 lines of code Detections/SecurityEvent/GroupCreatedAddedToPrivlegeGroup_1h.yaml x: 140 contributors (all time) y: 150 lines of code Detections/SecurityEvent/PotentialKerberoast.yaml x: 137 contributors (all time) y: 118 lines of code Detections/SecurityEvent/UserAccountAddedToPrivlegeGroup_1h.yaml x: 155 contributors (all time) y: 112 lines of code Detections/SecurityEvent/UserAccountCreatedDeleted_10m.yaml x: 141 contributors (all time) y: 148 lines of code Detections/SecurityEvent/UserAccountEnabledDisabled_10m.yaml x: 142 contributors (all time) y: 149 lines of code Detections/W3CIISLog/HighFailedLogonCountByClientIP.yaml x: 116 contributors (all time) y: 92 lines of code Detections/W3CIISLog/HighPortCountByClientIP.yaml x: 104 contributors (all time) y: 80 lines of code Detections/W3CIISLog/ProxyShellPwn2Own.yaml x: 74 contributors (all time) y: 65 lines of code Detections/ZoomLogs/E2EEDisbaled.yaml x: 106 contributors (all time) y: 42 lines of code Detections/ZoomLogs/ExternalUserAccess.yaml x: 123 contributors (all time) y: 51 lines of code Detections/ZoomLogs/JoiningMeetingFromAnotherTimeZone.yaml x: 128 contributors (all time) y: 58 lines of code Hunting Queries/CloudAppEvents/SetPolicyConfigInCloudAppEvents.yaml x: 20 contributors (all time) y: 35 lines of code Hunting Queries/Microsoft 365 Defender/Credential Access/Attempts to request Kerberos service ticket using the AS service.yaml x: 19 contributors (all time) y: 34 lines of code Hunting Queries/Microsoft 365 Defender/Execution/detect-impacket-atexec.yaml x: 21 contributors (all time) y: 36 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationSentinelOne.yaml x: 31 contributors (all time) y: 227 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoASA.yaml x: 46 contributors (all time) y: 351 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoISE.yaml x: 49 contributors (all time) y: 352 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCrowdStrikeFalconHost.yaml x: 33 contributors (all time) y: 182 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftMD4IoT.yaml x: 51 contributors (all time) y: 144 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationPaloAltoCortexDataLake.yaml x: 31 contributors (all time) y: 253 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationPostgreSQL.yaml x: 79 contributors (all time) y: 494 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSentinelOne.yaml x: 31 contributors (all time) y: 323 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSshd.yaml x: 59 contributors (all time) y: 337 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSudo.yaml x: 19 contributors (all time) y: 258 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationVMwareCarbonBlackCloud.yaml x: 33 contributors (all time) y: 155 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionSonicWallFirewall.yaml x: 15 contributors (all time) y: 407 lines of code Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/Log4jVulnerableMachines.yaml x: 70 contributors (all time) y: 38 lines of code Solutions/AtlassianJiraAudit/Data Connectors/JiraAuditAPISentinelConnector/__init__.py x: 61 contributors (all time) y: 118 lines of code Solutions/AtlassianJiraAudit/Playbooks/Sync-CommentsFunctionApp/Sync-Comment.ps1 x: 41 contributors (all time) y: 87 lines of code Solutions/Auth0/Data Connectors/Auth0Connector/main.py x: 78 contributors (all time) y: 321 lines of code Solutions/Azure Key Vault/Analytic Rules/KeyvaultMassSecretRetrieval.yaml x: 77 contributors (all time) y: 80 lines of code Solutions/Azure Key Vault/Analytic Rules/TimeSeriesKeyvaultAccessAnomaly.yaml x: 73 contributors (all time) y: 85 lines of code Solutions/Azure SQL Database solution for sentinel/Analytic Rules/Detection-VolumeResponseRowsStatefulAnomalyOnDatabase.yaml x: 61 contributors (all time) y: 83 lines of code Solutions/BitSight/Parsers/BitSightCompanyDetails.yaml x: 40 contributors (all time) y: 115 lines of code Solutions/Bitwarden/Parsers/BitwardenEventLogs.yaml x: 19 contributors (all time) y: 129 lines of code Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/SuspiciousAccessOfBECRelatedDocumentsInAWSS3Buckets.yaml x: 49 contributors (all time) y: 72 lines of code Solutions/CiscoWSA/Parsers/CiscoWSAEvent.yaml x: 43 contributors (all time) y: 141 lines of code Solutions/Cloud Identity Threat Protection Essentials/Analytic Rules/NewExtUserGrantedAdmin.yaml x: 69 contributors (all time) y: 87 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeFalconAdversaryIntelligence/CrowdStrikeFalconThreatIntelConnector/__init__.py x: 19 contributors (all time) y: 187 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeFalconAdversaryIntelligence/CrowdStrikeFalconThreatIntelConnector/utils.py x: 19 contributors (all time) y: 107 lines of code Solutions/Cybersixgill-Actionable-Alerts/Data Connectors/CybersixgillAlerts/__init__.py x: 65 contributors (all time) y: 192 lines of code Solutions/FalconFriday/Analytic Rules/DisableOrModifyWindowsDefender.yaml x: 57 contributors (all time) y: 5 lines of code Solutions/FalconFriday/Analytic Rules/RecognizingBeaconingTraffic.yaml x: 57 contributors (all time) y: 79 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/SingletonEternalOrchestrator/__init__.py x: 30 contributors (all time) y: 145 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/globalVariables.py x: 30 contributors (all time) y: 4 lines of code Solutions/HYAS Protect/Data Connectors/HyasProtect/__init__.py x: 35 contributors (all time) y: 184 lines of code Solutions/HolmSecurity/Data Connectors/AzureFunctionHolmSecurityAssetsConn/__init__.py x: 38 contributors (all time) y: 103 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Impact/AnomalousVoulmeOfFileDeletion.yaml x: 25 contributors (all time) y: 79 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/PotentialBuildProcessCompromiseMDE.yaml x: 34 contributors (all time) y: 71 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs.yaml x: 34 contributors (all time) y: 58 lines of code Solutions/Microsoft Entra ID Protection/Analytic Rules/CorrelateIPC_Unfamiliar-Atypical.yaml x: 38 contributors (all time) y: 122 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AccountCreatedandDeletedinShortTimeframe.yaml x: 35 contributors (all time) y: 105 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AdminPromoAfterRoleMgmtAppPermissionGrant.yaml x: 35 contributors (all time) y: 133 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AuthenticationMethodsChangedforPrivilegedAccount.yaml x: 44 contributors (all time) y: 81 lines of code Solutions/Microsoft Entra ID/Analytic Rules/ExchangeFullAccessGrantedToApp.yaml x: 47 contributors (all time) y: 96 lines of code Solutions/Microsoft Entra ID/Analytic Rules/FailedLogonToAzurePortal.yaml x: 47 contributors (all time) y: 106 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SigninPasswordSpray.yaml x: 43 contributors (all time) y: 86 lines of code Solutions/Microsoft Exchange Security - Exchange Online/Parsers/ExchangeConfiguration.yaml x: 60 contributors (all time) y: 330 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/BrutforceAttemptOnAzurePortalAndAWSConsolAtSameTime.yaml x: 36 contributors (all time) y: 104 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/Cross-CloudSuspiciousComputeResourcecreationinGCP.yaml x: 41 contributors (all time) y: 179 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/CrossCloudSuspiciousUserActivityObservedInGCPEnvourment.yaml x: 41 contributors (all time) y: 151 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuccessfulAWSConsoleLoginfromIPAddressObservedConductingPasswordSpray.yaml x: 36 contributors (all time) y: 125 lines of code Solutions/Multi Cloud Attack Coverage Essentials - Resource Abuse/Analytic Rules/SuspiciousAWSConsolLoginByCredentialAceessAlerts.yaml x: 36 contributors (all time) y: 130 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/NetskopeToAzureStorage/netskope_api_async.py x: 20 contributors (all time) y: 164 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/NetskopeToAzureStorage/netskope_to_azure_storage.py x: 20 contributors (all time) y: 699 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/SharedCode/__init__.py x: 20 contributors (all time) y: 1 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/StorageToSentinel/netskope_azure_storage_to_sentinel.py x: 20 contributors (all time) y: 320 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/StorageToSentinel/remove_duplicates_in_azure_storage.py x: 20 contributors (all time) y: 411 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/StorageToSentinel/sentinel.py x: 20 contributors (all time) y: 93 lines of code Solutions/Netskopev2/Data Connectors/NetskopeDataConnector/WebTxMetrics/ingest_message.py x: 20 contributors (all time) y: 125 lines of code Solutions/Netskopev2/Parsers/AlertsCompromisedCredential.yaml x: 20 contributors (all time) y: 102 lines of code Solutions/Netskopev2/Parsers/AlertsCtep.yaml x: 20 contributors (all time) y: 153 lines of code Solutions/Netskopev2/Parsers/AlertsMalsite.yaml x: 20 contributors (all time) y: 261 lines of code Solutions/Netskopev2/Parsers/AlertsMalware.yaml x: 20 contributors (all time) y: 289 lines of code Solutions/Netskopev2/Parsers/AlertsPolicy.yaml x: 20 contributors (all time) y: 447 lines of code Solutions/Netskopev2/Parsers/AlertsRemediation.yaml x: 20 contributors (all time) y: 205 lines of code Solutions/Netskopev2/Parsers/AlertsSecurityAssessment.yaml x: 20 contributors (all time) y: 129 lines of code Solutions/Netskopev2/Parsers/AlertsUba.yaml x: 20 contributors (all time) y: 326 lines of code Solutions/Network Session Essentials/Analytic Rules/AnomalyFoundInNetworkSessionTraffic.yaml x: 45 contributors (all time) y: 192 lines of code Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByAnomalyBasedDetection.yaml x: 54 contributors (all time) y: 192 lines of code Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByStaticThreshold.yaml x: 45 contributors (all time) y: 151 lines of code Solutions/Network Session Essentials/Analytic Rules/ExcessiveHTTPFailuresFromSource.yaml x: 58 contributors (all time) y: 94 lines of code Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml x: 67 contributors (all time) y: 107 lines of code Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByAnomalyHunting.yaml x: 56 contributors (all time) y: 173 lines of code Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByStaticThresholdHunting.yaml x: 45 contributors (all time) y: 131 lines of code Solutions/Network Session Essentials/Hunting Queries/DetectsSeveralUsersWithTheSameMACAddress.yaml x: 45 contributors (all time) y: 72 lines of code Solutions/Network Threat Protection Essentials/Analytic Rules/NewUserAgentLast24h.yaml x: 63 contributors (all time) y: 84 lines of code Solutions/Proofpoint On demand(POD) Email Security/Parsers/ProofpointPOD.yaml x: 44 contributors (all time) y: 317 lines of code Solutions/SecurityThreatEssentialSolution/Analytic Rules/Threat_Essentials_TimeSeriesAnomaly-MultiVendor_DataExfiltration.yaml x: 84 contributors (all time) y: 121 lines of code Solutions/SecurityThreatEssentialSolution/Analytic Rules/Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml x: 77 contributors (all time) y: 59 lines of code Solutions/SenservaPro/Analytic Rules/BlockLegacyAuthentication.yaml x: 80 contributors (all time) y: 44 lines of code Solutions/SenservaPro/Analytic Rules/PasswordAgePolicyNew.yaml x: 80 contributors (all time) y: 24 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/models/oat.py x: 65 contributors (all time) y: 411 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/models/rca.py x: 22 contributors (all time) y: 1 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/services/oat_service.py x: 79 contributors (all time) y: 284 lines of code Solutions/Web Session Essentials/Analytic Rules/CommandInURL.yaml x: 48 contributors (all time) y: 81 lines of code Solutions/Web Session Essentials/Analytic Rules/DataExfiltrationTimeSeriesAnomaly.yaml x: 49 contributors (all time) y: 245 lines of code Solutions/Web Session Essentials/Analytic Rules/PossibleMaliciousDoubleExtension.yaml x: 49 contributors (all time) y: 88 lines of code Solutions/Web Session Essentials/Analytic Rules/PrivateIPInURL.yaml x: 48 contributors (all time) y: 110 lines of code Solutions/Web Session Essentials/Analytic Rules/RarelyRequestedResources.yaml x: 56 contributors (all time) y: 101 lines of code Solutions/Windows Security Events/Analytic Rules/LocalDeviceJoinInfoAndTransportKeyRegKeysAccess.yaml x: 77 contributors (all time) y: 106 lines of code Solutions/Windows Security Events/Analytic Rules/MultipleFailedFollowedBySuccess.yaml x: 74 contributors (all time) y: 74 lines of code Solutions/Zinc Open Source/Analytic Rules/ZincOctober2022_IP_Domain_Hash_IOC.yaml x: 92 contributors (all time) y: 195 lines of code Tools/ConvertYamlToJson/ConvertSentinelRuleFrom-Yaml.ps1 x: 60 contributors (all time) y: 177 lines of code ASIM/schemas/entities/ASimApp.yaml x: 81 contributors (all time) y: 31 lines of code DataConnectors/M365Defender-VulnerabilityManagement/maintenance/buildFiles.ps1 x: 50 contributors (all time) y: 2 lines of code DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py x: 82 contributors (all time) y: 673 lines of code Detections/MultipleDataSources/Accountcreatedfromnon-approvedsources.yaml x: 73 contributors (all time) y: 103 lines of code Detections/SecurityEvent/password_never_expires.yaml x: 137 contributors (all time) y: 107 lines of code Hunting Queries/SigninLogs/MFAUserBlocked.yaml x: 107 contributors (all time) y: 101 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventVMwareCarbonBlackCloud.yaml x: 38 contributors (all time) y: 316 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventEmpty.yaml x: 57 contributors (all time) y: 146 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventVMwareCarbonBlackCloud.yaml x: 38 contributors (all time) y: 375 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationAADNonInteractive.yaml x: 94 contributors (all time) y: 103 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationAADServicePrincipalSignInLogs.yaml x: 84 contributors (all time) y: 133 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationGoogleWorkspace.yaml x: 25 contributors (all time) y: 153 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationPaloAltoCortexDataLake.yaml x: 24 contributors (all time) y: 172 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationSalesforceSC.yaml x: 26 contributors (all time) y: 347 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAADManagedIdentity.yaml x: 78 contributors (all time) y: 188 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAADNonInteractive.yaml x: 80 contributors (all time) y: 194 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAADServicePrincipalSignInLogs.yaml x: 78 contributors (all time) y: 260 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationAADSigninLogs.yaml x: 80 contributors (all time) y: 203 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationEmpty.yaml x: 76 contributors (all time) y: 153 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationGoogleWorkspace.yaml x: 28 contributors (all time) y: 235 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationM365Defender.yaml x: 86 contributors (all time) y: 386 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSalesforceSC.yaml x: 29 contributors (all time) y: 446 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationSu.yaml x: 47 contributors (all time) y: 222 lines of code Parsers/ASimDhcpEvent/Parsers/vimDhcpEventEmpty.yaml x: 23 contributors (all time) y: 132 lines of code Parsers/ASimDns/Parsers/vimDnsFortinetFortigate.yaml x: 33 contributors (all time) y: 273 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventGoogleWorkspace.yaml x: 25 contributors (all time) y: 285 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventEmpty.yaml x: 63 contributors (all time) y: 161 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventGoogleWorkspace.yaml x: 25 contributors (all time) y: 343 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionPaloAltoCEF.yaml x: 86 contributors (all time) y: 131 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionSonicWallFirewall.yaml x: 21 contributors (all time) y: 385 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAWSVPC.yaml x: 73 contributors (all time) y: 292 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCorelightZeek.yaml x: 51 contributors (all time) y: 190 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionPaloAltoCEF.yaml x: 91 contributors (all time) y: 180 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSonicWallFirewall.yaml x: 21 contributors (all time) y: 435 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionVMConnection.yaml x: 81 contributors (all time) y: 260 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionWatchGuardFirewareOS.yaml x: 47 contributors (all time) y: 207 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessEventTerminate.yaml x: 61 contributors (all time) y: 41 lines of code Parsers/ASimProcessEvent/Parsers/imProcessCreate.yaml x: 98 contributors (all time) y: 88 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventEmpty.yaml x: 53 contributors (all time) y: 117 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementCiscoISE.yaml x: 46 contributors (all time) y: 130 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementLinuxAuthpriv.yaml x: 35 contributors (all time) y: 318 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementNative.yaml x: 22 contributors (all time) y: 52 lines of code Parsers/ASimUserManagement/Parsers/ASimUserManagementSentinelOne.yaml x: 36 contributors (all time) y: 178 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementCiscoISE.yaml x: 50 contributors (all time) y: 173 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementLinuxAuthpriv.yaml x: 35 contributors (all time) y: 411 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementNative.yaml x: 22 contributors (all time) y: 90 lines of code Parsers/ASimUserManagement/Parsers/vimUserManagementSentinelOne.yaml x: 36 contributors (all time) y: 221 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_GuardDuty_template.yaml x: 82 contributors (all time) y: 151 lines of code Solutions/Armis/Data Connectors/ArmisActivities/ArmisActivitySentinelConnector/__init__.py x: 62 contributors (all time) y: 367 lines of code Solutions/Azure Activity/Analytic Rules/AADHybridHealthADFSNewServer.yaml x: 72 contributors (all time) y: 46 lines of code Solutions/Azure Activity/Analytic Rules/Granting_Permissions_To_Account_detection.yaml x: 56 contributors (all time) y: 65 lines of code Solutions/Azure Activity/Analytic Rules/TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml x: 66 contributors (all time) y: 59 lines of code Solutions/Azure Firewall/Analytic Rules/SeveralDenyActionsRegistered.yaml x: 84 contributors (all time) y: 70 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/PortFolioCompanies/__init__.py x: 23 contributors (all time) y: 19 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/SharedCode/azure_sentinel.py x: 44 contributors (all time) y: 85 lines of code Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/AccountElevatedtoNewRole.yaml x: 59 contributors (all time) y: 87 lines of code Solutions/Business Email Compromise - Financial Fraud/Hunting Queries/UserLoginIPAddressTeleportation.yaml x: 64 contributors (all time) y: 112 lines of code Solutions/Business Email Compromise - Financial Fraud/Hunting Queries/riskSignInWithNewMFAMethod.yaml x: 64 contributors (all time) y: 94 lines of code Solutions/Cisco ETD/Data Connectors/CiscoETDAzureSentinelConnector/__init__.py x: 21 contributors (all time) y: 199 lines of code Solutions/CiscoDuoSecurity/Parsers/CiscoDuo.yaml x: 46 contributors (all time) y: 97 lines of code Solutions/CiscoUmbrella/Data Connectors/ciscoUmbrellaDataConn/__init__.py x: 70 contributors (all time) y: 543 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/Signins-from-NordVPN-Providers.yaml x: 89 contributors (all time) y: 72 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/SuspiciousSignintoPrivilegedAccount.yaml x: 88 contributors (all time) y: 92 lines of code Solutions/Endpoint Threat Protection Essentials/Analytic Rules/SuspiciousPowerShellCommandExecuted.yaml x: 30 contributors (all time) y: 69 lines of code Solutions/Endpoint Threat Protection Essentials/Hunting Queries/BackupDeletion.yaml x: 56 contributors (all time) y: 90 lines of code Solutions/Endpoint Threat Protection Essentials/Hunting Queries/SuspiciousPowerShellCommandExecution.yaml x: 25 contributors (all time) y: 57 lines of code Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/sentinel/__init__.py x: 23 contributors (all time) y: 1 lines of code Solutions/GoogleWorkspaceReports/Data Connectors/GWorkspaceReportsAPISentinelConn/GWorkspaceReports-TimeTrigger/__init__.py x: 23 contributors (all time) y: 207 lines of code Solutions/GoogleWorkspaceReports/Data Connectors/get_google_pickle_string.py x: 44 contributors (all time) y: 12 lines of code Solutions/Microsoft 365/Analytic Rules/SharePoint_Downloads_byNewIP.yaml x: 70 contributors (all time) y: 71 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Campaign/Jupyter-Solarmaker/DeimosComponentExecution.yaml x: 17 contributors (all time) y: 45 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Command and Control/C2-NamedPipe.yaml x: 17 contributors (all time) y: 82 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Persistence/RareProcessAsService.yaml x: 17 contributors (all time) y: 85 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Campaigns/Bazacall/PayloadDropUsingCertUtil.yaml x: 24 contributors (all time) y: 4 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Campaigns/Jupyter-Solarmaker/DeimosComponentExecution.yaml x: 28 contributors (all time) y: 22 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Exploits/PrintNightmareUsageDetection-CVE-2021-1675.yaml x: 28 contributors (all time) y: 8 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Ransomware/MultiProcessKillWithTaskKill.yaml x: 29 contributors (all time) y: 20 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SuspiciousAADJoinedDeviceUpdate.yaml x: 45 contributors (all time) y: 102 lines of code Solutions/Microsoft Entra ID/Analytic Rules/UserAccounts-CABlockedSigninSpikes.yaml x: 50 contributors (all time) y: 114 lines of code Solutions/Network Threat Protection Essentials/Hunting Queries/B64IPInURL.yaml x: 63 contributors (all time) y: 73 lines of code Solutions/Network Threat Protection Essentials/Hunting Queries/RiskyCommandB64EncodedInUrl.yaml x: 62 contributors (all time) y: 73 lines of code Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Flow_Logs_High_Severity.yaml x: 50 contributors (all time) y: 52 lines of code Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml x: 45 contributors (all time) y: 60 lines of code Solutions/Syslog/Hunting Queries/SchedTaskAggregation.yaml x: 42 contributors (all time) y: 9 lines of code Solutions/VMware Carbon Black Cloud/Data Connectors/AzureFunctionVMwareCarbonBlack/AlertsApiTimer/run.ps1 x: 22 contributors (all time) y: 307 lines of code Solutions/VMware Carbon Black Cloud/Data Connectors/AzureFunctionVMwareCarbonBlack/AuditEventsAlertsTimer/run.ps1 x: 22 contributors (all time) y: 375 lines of code Solutions/VMware SD-WAN and SASE/Analytic Rules/vmw-sdwan-ipfrag-attempt.yaml x: 22 contributors (all time) y: 67 lines of code Solutions/VMware SD-WAN and SASE/Data Connectors/Function App Connector/vmw_sdwan_sase_funcapp/cws_dlplogs/__init__.py x: 22 contributors (all time) y: 283 lines of code Solutions/VMware SD-WAN and SASE/Data Connectors/Function App Connector/vmw_sdwan_sase_funcapp/cws_healthcheck/__init__.py x: 22 contributors (all time) y: 179 lines of code Solutions/VMware SD-WAN and SASE/Data Connectors/Function App Connector/vmw_sdwan_sase_funcapp/cws_weblogs/__init__.py x: 22 contributors (all time) y: 248 lines of code Solutions/VMware SD-WAN and SASE/Data Connectors/Function App Connector/vmw_sdwan_sase_funcapp/sdwan_efslogs/__init__.py x: 22 contributors (all time) y: 547 lines of code Solutions/Windows Security Events/Hunting Queries/ProcessEntropy.yaml x: 62 contributors (all time) y: 150 lines of code Solutions/Windows Security Events/Hunting Queries/Suspicious_Windows_Login_outside_normal_hours.yaml x: 62 contributors (all time) y: 123 lines of code Tools/PowerShell/SentinelAnalyticRulesManagementScript.ps1 x: 17 contributors (all time) y: 1107 lines of code Parsers/ASimRegistryEvent/Parsers/VimRegistryEventMicrosoftSecurityEvent.yaml x: 1 contributors (all time) y: 172 lines of code ASIM/dev/ASimTester/filteringTest/ASimFilteringTest.py x: 41 contributors (all time) y: 484 lines of code ASIM/schemas/ASimAuthentication.yaml x: 71 contributors (all time) y: 106 lines of code ASIM/schemas/ASimDns.yaml x: 72 contributors (all time) y: 256 lines of code ASIM/schemas/ASimFileEvent.yaml x: 78 contributors (all time) y: 232 lines of code ASIM/schemas/ASimUserManagement.yaml x: 36 contributors (all time) y: 95 lines of code ASIM/schemas/common/ASimEnumerations.yaml x: 68 contributors (all time) y: 112 lines of code ASIM/schemas/common/ASimEventFields.yaml x: 56 contributors (all time) y: 120 lines of code ASIM/schemas/entities/ASimExtendedProcess.yaml x: 61 contributors (all time) y: 10 lines of code ASIM/schemas/entities/ASimProcess.yaml x: 63 contributors (all time) y: 10 lines of code ASIM/schemas/entities/ASimSystem.yaml x: 70 contributors (all time) y: 107 lines of code DataConnectors/CEF/cef_installer.py x: 94 contributors (all time) y: 554 lines of code DataConnectors/CEF/cef_troubleshoot.py x: 101 contributors (all time) y: 653 lines of code DataConnectors/DocuSign-SecurityEvents/AzureFunctionDocuSignMonitor/DocuSignMonitorTimerTrigger/run.ps1 x: 57 contributors (all time) y: 381 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_C#/Template_REST_API_Function_App_C#.cs x: 32 contributors (all time) y: 237 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/eventsHandler.rb x: 29 contributors (all time) y: 43 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashAutoResizeBuffer.rb x: 29 contributors (all time) y: 104 lines of code Detections/ASimAuthentication/imAuthPasswordSpray.yaml x: 85 contributors (all time) y: 46 lines of code Detections/ASimAuthentication/imSigninAttemptsByIPviaDisabledAccounts.yaml x: 79 contributors (all time) y: 54 lines of code Detections/ASimDNS/imDNS_Miners.yaml x: 113 contributors (all time) y: 89 lines of code Detections/ASimDNS/imDns_DomainEntity_DnsEvents.yaml x: 74 contributors (all time) y: 4 lines of code Detections/ASimFileEvent/imFileESolarWindsSunburstSupernova.yaml x: 100 contributors (all time) y: 31 lines of code Detections/ASimNetworkSession/IPEntity_imNetworkSession.yaml x: 66 contributors (all time) y: 4 lines of code Detections/ASimNetworkSession/PortScan.yaml x: 64 contributors (all time) y: 4 lines of code Detections/ASimProcess/imProcess_base64_encoded_pefile.yaml x: 88 contributors (all time) y: 30 lines of code Detections/ASimProcess/imProcess_malware_in_recyclebin.yaml x: 96 contributors (all time) y: 30 lines of code Detections/ASimWebSession/PotentiallyHarmfulFileTypes.yaml x: 102 contributors (all time) y: 85 lines of code Detections/AWSCloudTrail/AWS_ChangeToRDSDatabase.yaml x: 109 contributors (all time) y: 5 lines of code Detections/AWSCloudTrail/AWS_ChangeToVPC.yaml x: 117 contributors (all time) y: 5 lines of code Detections/AWSCloudTrail/AWS_ClearStopChangeTrailLogs.yaml x: 111 contributors (all time) y: 5 lines of code Detections/AWSCloudTrail/AWS_ConsoleLogonWithoutMFA.yaml x: 101 contributors (all time) y: 5 lines of code Detections/AWSCloudTrail/SuspiciousAccessOfBECRelatedDocumentsInAWSS3Buckets.yaml x: 56 contributors (all time) y: 5 lines of code Detections/AWSGuardDuty/AWS_GuardDuty_template.yaml x: 81 contributors (all time) y: 4 lines of code Detections/AuditLogs/ADFSDomainTrustMods.yaml x: 131 contributors (all time) y: 5 lines of code Detections/AuditLogs/AccountCreatedDeletedByNonApprovedUser.yaml x: 85 contributors (all time) y: 5 lines of code Detections/AuditLogs/AccountCreatedandDeletedinShortTimeframe.yaml x: 91 contributors (all time) y: 5 lines of code Detections/AuditLogs/AccountElevatedtoNewRole.yaml x: 58 contributors (all time) y: 5 lines of code Detections/AuditLogs/AdditionofaTemporaryAccessPasstoaPrivilegedAccount.yaml x: 78 contributors (all time) y: 82 lines of code Detections/AuditLogs/AdminPromoAfterRoleMgmtAppPermissionGrant.yaml x: 98 contributors (all time) y: 5 lines of code Detections/AuditLogs/BulkChangestoPrivilegedAccountPermissions.yaml x: 84 contributors (all time) y: 5 lines of code Detections/AuditLogs/ConditionalAccessPolicyModifiedbyNewUser.yaml x: 79 contributors (all time) y: 79 lines of code Detections/AuditLogs/CredentialAddedAfterAdminConsent.yaml x: 120 contributors (all time) y: 5 lines of code Detections/AuditLogs/Cross-tenantAccessSettingsOrganizationAdded.yaml x: 62 contributors (all time) y: 6 lines of code Detections/AuditLogs/FirstAppOrServicePrincipalCredential.yaml x: 137 contributors (all time) y: 5 lines of code Detections/AuditLogs/GuestAccountsAddedinAADGroupsOtherThanTheOnesSpecified.yaml x: 72 contributors (all time) y: 6 lines of code Detections/AuditLogs/MaliciousOAuthApp_O365AttackToolkit.yaml x: 118 contributors (all time) y: 5 lines of code Detections/AuditLogs/MultipleAdmin_membership_removals_from_NewAdmin.yaml x: 77 contributors (all time) y: 5 lines of code Detections/AuditLogs/NRT_ADFSDomainTrustMods.yaml x: 86 contributors (all time) y: 5 lines of code Detections/AuditLogs/NRT_AuthenticationMethodsChangedforVIPUsers.yaml x: 65 contributors (all time) y: 6 lines of code Detections/AuditLogs/NRT_UseraddedtoPrivilgedGroups.yaml x: 88 contributors (all time) y: 5 lines of code Detections/AuditLogs/NewAppOrServicePrincipalCredential.yaml x: 134 contributors (all time) y: 5 lines of code Detections/AuditLogs/NewExtUserGrantedAdmin.yaml x: 53 contributors (all time) y: 5 lines of code Detections/AuditLogs/PrivlegedRoleAssignedOutsidePIM.yaml x: 95 contributors (all time) y: 5 lines of code Detections/AuditLogs/ServicePrincipalAssignedAppRoleWithSensitiveAccess.yaml x: 71 contributors (all time) y: 93 lines of code Detections/AuditLogs/SuspiciousOAuthApp_OfflineAccess.yaml x: 115 contributors (all time) y: 5 lines of code Detections/AuditLogs/SuspiciousServicePrincipalcreationactivity.yaml x: 100 contributors (all time) y: 5 lines of code Detections/AuditLogs/URLAddedtoApplicationfromUnknownDomain.yaml x: 92 contributors (all time) y: 101 lines of code Detections/AuditLogs/UserAccountCreatedUsingIncorrectNamingFormat.yaml x: 56 contributors (all time) y: 82 lines of code Detections/AuditLogs/UserAssignedPrivilegedRole.yaml x: 92 contributors (all time) y: 5 lines of code Detections/AuditLogs/UseraddedtoPrivilgedGroups.yaml x: 142 contributors (all time) y: 5 lines of code Detections/AzureActivity/AzDiagSettingsDeleted.yaml x: 71 contributors (all time) y: 67 lines of code Detections/AzureActivity/Creation_of_Expensive_Computes_in_Azure.yaml x: 60 contributors (all time) y: 4 lines of code Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml x: 122 contributors (all time) y: 4 lines of code Detections/AzureActivity/New-CloudShell-User.yaml x: 94 contributors (all time) y: 4 lines of code Detections/AzureActivity/NewResourceGroupsDeployedTo.yaml x: 108 contributors (all time) y: 4 lines of code Detections/AzureActivity/RareOperations.yaml x: 104 contributors (all time) y: 4 lines of code Detections/AzureDiagnostics/AzureWAFmatching_log4j_vuln.yaml x: 70 contributors (all time) y: 5 lines of code Detections/AzureDiagnostics/KeyVaultSensitiveOperations.yaml x: 119 contributors (all time) y: 5 lines of code Detections/AzureDiagnostics/KeyvaultMassSecretRetrieval.yaml x: 125 contributors (all time) y: 5 lines of code Detections/AzureFirewall/SeveralDenyActionsRegistered.yaml x: 121 contributors (all time) y: 5 lines of code Detections/CiscoUmbrella/CiscoUmbrellaHackToolUserAgentDetected.yaml x: 92 contributors (all time) y: 82 lines of code Detections/CommonSecurityLog/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 83 contributors (all time) y: 5 lines of code Detections/CommonSecurityLog/PaloAlto-PortScanning.yaml x: 102 contributors (all time) y: 5 lines of code Detections/CommonSecurityLog/PaloAlto-UnusualThreatSignatures.yaml x: 40 contributors (all time) y: 5 lines of code Detections/DeviceFileEvents/SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs.yaml x: 132 contributors (all time) y: 5 lines of code Detections/DeviceNetworkEvents/SolarWinds_SUNBURST_Network-IOCs.yaml x: 133 contributors (all time) y: 5 lines of code Detections/DnsEvents/DNS_HighNXDomainCount_detection.yaml x: 105 contributors (all time) y: 5 lines of code Detections/DnsEvents/DNS_TorProxies.yaml x: 106 contributors (all time) y: 5 lines of code Detections/DuoSecurity/IPEntity_DuoSecurity.yaml x: 59 contributors (all time) y: 5 lines of code Detections/GitHub/Security Vulnerability in Repo.yaml x: 90 contributors (all time) y: 6 lines of code Detections/MultipleDataSources/AADAWSConsoleCorrelation.yaml x: 119 contributors (all time) y: 84 lines of code Detections/MultipleDataSources/ADFS-DKM-MasterKey-Export.yaml x: 126 contributors (all time) y: 98 lines of code Detections/MultipleDataSources/AWSConsoleAADCorrelation.yaml x: 133 contributors (all time) y: 69 lines of code Detections/MultipleDataSources/AquaBlizzardFeb2022.yaml x: 55 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/BariumIPIOC112020.yaml x: 144 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/CrossCloudUnauthorizedCredentialsAccessDetection.yaml x: 47 contributors (all time) y: 3 lines of code Detections/MultipleDataSources/Dev-0228FilePathHashesNovember2021.yaml x: 98 contributors (all time) y: 77 lines of code Detections/MultipleDataSources/Dev-0530_FileExtRename.yaml x: 76 contributors (all time) y: 60 lines of code Detections/MultipleDataSources/Dev-0530_July2022.yaml x: 75 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/EUROPIUM _September2022.yaml x: 74 contributors (all time) y: 159 lines of code Detections/MultipleDataSources/ExchangeServerVulnerabilitiesMarch2021IoCs.yaml x: 145 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/GainCodeExecutionADFSviaWMI.yaml x: 102 contributors (all time) y: 171 lines of code Detections/MultipleDataSources/HostAADCorrelation.yaml x: 127 contributors (all time) y: 102 lines of code Detections/MultipleDataSources/Mercury_Log4j_August2022.yaml x: 71 contributors (all time) y: 244 lines of code Detections/MultipleDataSources/NewUserAgentLast24h.yaml x: 107 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/PHOSPHORUSMarch2019IOCs.yaml x: 141 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/SUNSPOTLogFile.yaml x: 113 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/Solorigate-Network-Beacon.yaml x: 138 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/SucessfullSiginFromPhingLink.yaml x: 79 contributors (all time) y: 138 lines of code Detections/MultipleDataSources/WSLMalwareCorrelation.yaml x: 103 contributors (all time) y: 5 lines of code Detections/MultipleDataSources/ZincOctober2022_AVHits_IOC.yaml x: 39 contributors (all time) y: 5 lines of code Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml x: 114 contributors (all time) y: 5 lines of code Detections/OfficeActivity/RareOfficeOperations.yaml x: 128 contributors (all time) y: 5 lines of code Detections/OfficeActivity/SharePoint_Downloads_byNewIP.yaml x: 93 contributors (all time) y: 5 lines of code Detections/OfficeActivity/office_policytampering.yaml x: 112 contributors (all time) y: 5 lines of code Detections/SecurityAlert/Massdownload_USBFileCopy.yaml x: 67 contributors (all time) y: 131 lines of code Detections/SecurityAlert/Solorigate-Defender-Detections.yaml x: 116 contributors (all time) y: 60 lines of code Detections/SecurityAlert/Suspicious_WorkSpaceDeletion_Attempt.yaml x: 91 contributors (all time) y: 90 lines of code Detections/SecurityEvent/AADHealthMonAgentRegKeyAccess.yaml x: 97 contributors (all time) y: 139 lines of code Detections/SecurityEvent/AADHealthSvcAgentRegKeyAccess.yaml x: 88 contributors (all time) y: 137 lines of code Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml x: 76 contributors (all time) y: 5 lines of code Detections/SecurityEvent/COMEventSystemLoadingNewDLL.yaml x: 71 contributors (all time) y: 117 lines of code Detections/SecurityEvent/DSRMAccountAbuse.yaml x: 58 contributors (all time) y: 72 lines of code Detections/SecurityEvent/PotentialBuildProcessCompromise.yaml x: 110 contributors (all time) y: 121 lines of code Detections/SecurityEvent/RDP_MultipleConnectionsFromSingleSystem.yaml x: 128 contributors (all time) y: 96 lines of code Detections/SecurityEvent/RDP_RareConnection.yaml x: 117 contributors (all time) y: 103 lines of code Detections/SecurityEvent/SilkTyphoonSuspiciousUMServiceError.yaml x: 58 contributors (all time) y: 45 lines of code Detections/SecurityEvent/UserAccountAdd-Removed.yaml x: 131 contributors (all time) y: 129 lines of code Detections/SecurityEvent/UserCreatedAddedToBuiltinAdmins_1d.yaml x: 126 contributors (all time) y: 141 lines of code Detections/SecurityEvent/WDigestDowngradeAttack.yaml x: 51 contributors (all time) y: 5 lines of code Detections/SecurityEvent/gte_6_FailedLogons_10m.yaml x: 159 contributors (all time) y: 140 lines of code Detections/SigninLogs/AnomalousUserAppSigninLocationIncrease-detection.yaml x: 116 contributors (all time) y: 5 lines of code Detections/SigninLogs/BypassCondAccessRule.yaml x: 124 contributors (all time) y: 5 lines of code Detections/SigninLogs/DisabledAccountSigninsAcrossManyApplications.yaml x: 123 contributors (all time) y: 5 lines of code Detections/SigninLogs/DistribPassCrackAttempt.yaml x: 126 contributors (all time) y: 5 lines of code Detections/SigninLogs/FailedLogonToAzurePortal.yaml x: 135 contributors (all time) y: 5 lines of code Detections/SigninLogs/PrivilegedUserLogonfromnewASN.yaml x: 99 contributors (all time) y: 66 lines of code Detections/SigninLogs/SigninPasswordSpray.yaml x: 127 contributors (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/DomainEntity_Syslog.yaml x: 110 contributors (all time) y: 5 lines of code Detections/ThreatIntelligenceIndicator/IPEntity_AzureKeyVault.yaml x: 87 contributors (all time) y: 5 lines of code Detections/W3CIISLog/AnomomlousUserAgentConnection.yaml x: 106 contributors (all time) y: 63 lines of code Hunting Queries/ASimProcess/imProcess_ProcessEntropy.yaml x: 77 contributors (all time) y: 146 lines of code Hunting Queries/ASimProcess/imProcess_SolarWindsInventory.yaml x: 76 contributors (all time) y: 19 lines of code Hunting Queries/ASimProcess/imProcess_powershell_downloads.yaml x: 85 contributors (all time) y: 18 lines of code Hunting Queries/AuditLogs/AccountMFAModifications.yaml x: 26 contributors (all time) y: 36 lines of code Hunting Queries/AuditLogs/ConsentToApplicationDiscovery.yaml x: 95 contributors (all time) y: 99 lines of code Hunting Queries/AuditLogs/RareAuditActivityByApp.yaml x: 82 contributors (all time) y: 79 lines of code Hunting Queries/AzureActivity/Azure-CloudShell-Usage.yaml x: 93 contributors (all time) y: 42 lines of code Hunting Queries/AzureStorage/AzureStorageFileOnEndpoint.yaml x: 78 contributors (all time) y: 24 lines of code Hunting Queries/GitHub/Unusual Number of Repository Clones.yaml x: 79 contributors (all time) y: 32 lines of code Hunting Queries/Microsoft 365 Defender/Campaigns/redmenshen-bpfdoor-backdoor.yaml x: 47 contributors (all time) y: 21 lines of code Hunting Queries/Microsoft 365 Defender/Defense evasion/Discovering potentially tampered devices [Nobelium].yaml x: 49 contributors (all time) y: 9 lines of code Hunting Queries/Microsoft 365 Defender/Initial access/SuspiciousUrlClicked.yaml x: 88 contributors (all time) y: 18 lines of code Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm__all_netconn.yaml x: 29 contributors (all time) y: 185 lines of code Hunting Queries/MultipleDataSources/CriticalOperationsWithSystemrestore.yaml x: 52 contributors (all time) y: 103 lines of code Hunting Queries/MultipleDataSources/FirewallRuleChanges_using_netsh.yaml x: 64 contributors (all time) y: 145 lines of code Hunting Queries/MultipleDataSources/PermutationsOnLogonNames.yaml x: 80 contributors (all time) y: 124 lines of code Hunting Queries/MultipleDataSources/PossibleCommandInjectionagainstAzureIR.yaml x: 68 contributors (all time) y: 89 lines of code Hunting Queries/MultipleDataSources/RareDNSLookupWithDataTransfer.yaml x: 106 contributors (all time) y: 113 lines of code Hunting Queries/MultipleDataSources/TrackingPasswordChanges.yaml x: 85 contributors (all time) y: 87 lines of code Hunting Queries/MultipleDataSources/TrackingPrivAccounts.yaml x: 96 contributors (all time) y: 187 lines of code Hunting Queries/OfficeActivity/MultipleUsersEmailForwardedToSameDestination.yaml x: 33 contributors (all time) y: 4 lines of code Hunting Queries/SigninLogs/SuccessThenFail_SameUserDiffApp.yaml x: 83 contributors (all time) y: 65 lines of code Hunting Queries/SigninLogs/anomalous_app_azuread_signin.yaml x: 83 contributors (all time) y: 54 lines of code Hunting Queries/SigninLogs/signinBurstFromMultipleLocations.yaml x: 96 contributors (all time) y: 70 lines of code Hunting Queries/W3CIISLog/ClientIPwithManyUserAgents.yaml x: 98 contributors (all time) y: 38 lines of code Hunting Queries/W3CIISLog/Potential_IIS_BF.yaml x: 87 contributors (all time) y: 83 lines of code Hunting Queries/W3CIISLog/RareClientFileAccess.yaml x: 125 contributors (all time) y: 52 lines of code Hunting Queries/W3CIISLog/SuspectedMailBoxExportHostonOWA.yaml x: 104 contributors (all time) y: 26 lines of code Hunting Queries/WireData/WireDataBeacon.yaml x: 102 contributors (all time) y: 54 lines of code Hunting Queries/ZoomLogs/MultipleRegistrationDenies.yaml x: 88 contributors (all time) y: 46 lines of code Parsers/AS-StealthDefend/AS-StealthDefend.yaml x: 27 contributors (all time) y: 20 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCiscoISE.yaml x: 30 contributors (all time) y: 295 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventCrowdStrikeFalconHost.yaml x: 22 contributors (all time) y: 160 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventCiscoISE.yaml x: 30 contributors (all time) y: 360 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventCrowdStrikeFalconHost.yaml x: 22 contributors (all time) y: 217 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationAWSCloudTrail.yaml x: 75 contributors (all time) y: 112 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoASA.yaml x: 29 contributors (all time) y: 226 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoISE.yaml x: 41 contributors (all time) y: 257 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCrowdStrikeFalconHost.yaml x: 25 contributors (all time) y: 109 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationM365Defender.yaml x: 84 contributors (all time) y: 186 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationSshd.yaml x: 48 contributors (all time) y: 210 lines of code Parsers/ASimDns/Parsers/ASimDnsFortinetFortigate.yaml x: 23 contributors (all time) y: 214 lines of code Parsers/ASimDns/Parsers/ASimDnsInfobloxNIOS.yaml x: 78 contributors (all time) y: 92 lines of code Parsers/ASimDns/Parsers/ASimDnsMicrosoftNXlog.yaml x: 55 contributors (all time) y: 280 lines of code Parsers/ASimDns/Parsers/ASimDnsSentinelOne.yaml x: 24 contributors (all time) y: 196 lines of code Parsers/ASimDns/Parsers/vimDnsMicrosoftNXlog.yaml x: 52 contributors (all time) y: 335 lines of code Parsers/ASimDns/Parsers/vimDnsSentinelOne.yaml x: 24 contributors (all time) y: 248 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventAzureBlobStorage.yaml x: 26 contributors (all time) y: 85 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventAzureFileStorage.yaml x: 26 contributors (all time) y: 69 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoft365D.yaml x: 26 contributors (all time) y: 130 lines of code Parsers/ASimFileEvent/Parsers/ASimFileEventMicrosoftSharePoint.yaml x: 26 contributors (all time) y: 147 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventAzureTableStorage.yaml x: 44 contributors (all time) y: 156 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventM365D.yaml x: 77 contributors (all time) y: 207 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventMicrosoftSharePoint.yaml x: 58 contributors (all time) y: 232 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventNative.yaml x: 57 contributors (all time) y: 111 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventSentinelOne.yaml x: 38 contributors (all time) y: 172 lines of code Parsers/ASimFileEvent/Parsers/vimFileEventVMwareCarbonBlackCloud.yaml x: 26 contributors (all time) y: 211 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoFirepower.yaml x: 27 contributors (all time) y: 242 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoISE.yaml x: 41 contributors (all time) y: 159 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCrowdStrikeFalconHost.yaml x: 23 contributors (all time) y: 296 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionForcePointFirewall.yaml x: 38 contributors (all time) y: 341 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoft365Defender.yaml x: 82 contributors (all time) y: 194 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoFirepower.yaml x: 27 contributors (all time) y: 318 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoISE.yaml x: 41 contributors (all time) y: 226 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCrowdStrikeFalconHost.yaml x: 23 contributors (all time) y: 393 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionForcePointFirewall.yaml x: 38 contributors (all time) y: 416 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionFortinetFortiGate.yaml x: 75 contributors (all time) y: 176 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoft365Defender.yaml x: 90 contributors (all time) y: 274 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSentinelOne.yaml x: 24 contributors (all time) y: 228 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionVMwareCarbonBlackCloud.yaml x: 26 contributors (all time) y: 331 lines of code Parsers/ASimProcessEvent/Parsers/ASimProcessTerminateVMwareCarbonBlackCloud.yaml x: 24 contributors (all time) y: 112 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateSentinelOne.yaml x: 26 contributors (all time) y: 234 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateTrendMicroVisionOne.yaml x: 22 contributors (all time) y: 200 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessEmpty.yaml x: 66 contributors (all time) y: 177 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessEventNative.yaml x: 28 contributors (all time) y: 137 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateMicrosoftWindowsEvents.yaml x: 76 contributors (all time) y: 133 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessTerminateVMwareCarbonBlackCloud.yaml x: 24 contributors (all time) y: 187 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoft365D.yaml x: 37 contributors (all time) y: 158 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventNative.yaml x: 28 contributors (all time) y: 99 lines of code Parsers/ASimRegistryEvent/Parsers/vimRegistryEventTrendMicroVisionOne.yaml x: 24 contributors (all time) y: 100 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionApacheHTTPServer.yaml x: 33 contributors (all time) y: 71 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionCiscoFirepower.yaml x: 27 contributors (all time) y: 268 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionIIS.yaml x: 52 contributors (all time) y: 139 lines of code Solutions/Akamai Security Events/Parsers/AkamaiSIEMEvent.yaml x: 31 contributors (all time) y: 96 lines of code Solutions/Alibaba Cloud/Parsers/AliCloud.yaml x: 31 contributors (all time) y: 24 lines of code Solutions/Alsid For AD/Parsers/afad_parser.yaml x: 31 contributors (all time) y: 113 lines of code Solutions/Amazon Web Services/Analytic Rules/AWS_CreatedCRUDDyanmoDBPolicytoPrivilegeEscalation.yaml x: 73 contributors (all time) y: 77 lines of code Solutions/Amazon Web Services/Analytic Rules/SuspiciousAWSEC2ComputeResourceDeployments.yaml x: 41 contributors (all time) y: 48 lines of code Solutions/Armorblox/Analytic Rules/ArmorbloxNeedsReviewAlert.yaml x: 74 contributors (all time) y: 40 lines of code Solutions/AtlassianJiraAudit/Hunting Queries/JiraUserIPs.yaml x: 43 contributors (all time) y: 25 lines of code Solutions/Authomize/Data Connectors/AuthomizeSentinelConnector/__init__.py x: 29 contributors (all time) y: 123 lines of code Solutions/Azure Activity/Hunting Queries/AnomalousAzureOperationModel.yaml x: 48 contributors (all time) y: 121 lines of code Solutions/Azure SQL Database solution for sentinel/Hunting Queries/HuntingQuery-SuspiciousStoredProcedures.yaml x: 44 contributors (all time) y: 51 lines of code Solutions/BitSight/Parsers/BitSightAlerts.yaml x: 31 contributors (all time) y: 43 lines of code Solutions/Bitglass/Parsers/Bitglass.yaml x: 31 contributors (all time) y: 160 lines of code Solutions/Box/Data Connectors/AzureFunctionBox/main.py x: 89 contributors (all time) y: 158 lines of code Solutions/CTM360/Data Connectors/CBS/AzureFunctionCTM360_CBS/__init__.py x: 22 contributors (all time) y: 149 lines of code Solutions/Cisco SD-WAN/Parsers/CiscoSDWANNetflow.yaml x: 31 contributors (all time) y: 243 lines of code Solutions/CiscoDuoSecurity/Data Connectors/AzureFunctionCiscoDuo/main.py x: 114 contributors (all time) y: 373 lines of code Solutions/Citrix ADC/Parsers/CitrixADCEventOld.yaml x: 31 contributors (all time) y: 168 lines of code Solutions/Cloud Identity Threat Protection Essentials/Hunting Queries/UserGrantedAccess_GrantsOthersAccess.yaml x: 47 contributors (all time) y: 76 lines of code Solutions/Cloudflare/Parsers/Cloudflare.yaml x: 31 contributors (all time) y: 221 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/CofenseIntelligenceMalware/__init__.py x: 27 contributors (all time) y: 13 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/CofenseIntelligenceMalware/cofense_malware_data_to_sentinel.py x: 27 contributors (all time) y: 391 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/CofenseToSentinel/cofense_to_sentinel_mapping.py x: 27 contributors (all time) y: 60 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SentinelToDefender/__init__.py x: 27 contributors (all time) y: 34 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SentinelToDefender/defender.py x: 27 contributors (all time) y: 283 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SentinelToDefender/sentinel.py x: 27 contributors (all time) y: 711 lines of code Solutions/CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector/SharedCode/utils.py x: 27 contributors (all time) y: 433 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/IndicatorCreatorToDefender/sentinel.py x: 31 contributors (all time) y: 751 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/NonCofenseBasedIndicatorCreatorToCofense/sentinel.py x: 31 contributors (all time) y: 727 lines of code Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/SharedCode/utils.py x: 31 contributors (all time) y: 444 lines of code Solutions/CognyteLuminar/Data Connectors/Cognyte Luminar/__init__.py x: 24 contributors (all time) y: 403 lines of code Solutions/Corelight/Hunting Queries/CorelightDataTransferedByIp.yaml x: 50 contributors (all time) y: 25 lines of code Solutions/Corelight/Hunting Queries/CorelightMultipleRemoteSMBConnectionsFromSingleIP.yaml x: 54 contributors (all time) y: 26 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Parsers/CrowdStrikeReplicator.yaml x: 35 contributors (all time) y: 1074 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Parsers/CrowdStrikeReplicatorV2.yaml x: 47 contributors (all time) y: 155 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Parsers/CrowdStrikeReplicator_future.yaml x: 32 contributors (all time) y: 1123 lines of code Solutions/CyberArkEPM/DataConnectors/CyberArkEPMSentinelConnector/pyepm.py x: 49 contributors (all time) y: 184 lines of code Solutions/DNS Essentials/Analytic Rules/MultipleErrorsReportedForSameDNSQueryAnomalyBased.yaml x: 41 contributors (all time) y: 121 lines of code Solutions/Dataminr Pulse/Analytic Rules/DataminrSentinelAlerts.yaml x: 25 contributors (all time) y: 36 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlertsManualActivity/__init__.py x: 25 contributors (all time) y: 17 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlertsManualActivity/dataminrpulse_integration_settings.py x: 37 contributors (all time) y: 341 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseAlertsSentinelActivity/sentinel.py x: 25 contributors (all time) y: 94 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseThreatIntelligence/dataminr_pulse_to_threat_intelligence_mapping.py x: 28 contributors (all time) y: 118 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/DataminrPulseThreatIntelligence/sentinel.py x: 25 contributors (all time) y: 193 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/RetryFailedIndicators/post_to_log_analytics.py x: 25 contributors (all time) y: 115 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/RetryFailedIndicators/retry_failed_indicators.py x: 25 contributors (all time) y: 271 lines of code Solutions/Dataminr Pulse/Data Connectors/DataminrPulseAlerts/shared_code/validate_params.py x: 25 contributors (all time) y: 46 lines of code Solutions/Digital Shadows/Data Connectors/Digital Shadows/DigitalShadowsConnectorAzureFunction/DS_api.py x: 66 contributors (all time) y: 98 lines of code Solutions/Digital Shadows/Data Connectors/Digital Shadows/DigitalShadowsConnectorAzureFunction/__init__.py x: 66 contributors (all time) y: 27 lines of code Solutions/Digital Shadows/Data Connectors/Digital Shadows/DigitalShadowsConnectorAzureFunction/state_serializer.py x: 66 contributors (all time) y: 73 lines of code Solutions/Endpoint Threat Protection Essentials/Hunting Queries/PotentialMicrosoftSecurityServicesTampering.yaml x: 45 contributors (all time) y: 117 lines of code Solutions/Exabeam Advanced Analytics/Parsers/ExabeamEvent.yaml x: 31 contributors (all time) y: 104 lines of code Solutions/FalconFriday/Analytic Rules/DLLSideLoading.yaml x: 68 contributors (all time) y: 5 lines of code Solutions/Feedly/Data Connectors/FeedlySentinelConnector/feedly_downloader.py x: 30 contributors (all time) y: 19 lines of code Solutions/Feedly/Data Connectors/FeedlySentinelConnector/worker.py x: 30 contributors (all time) y: 74 lines of code Solutions/FireEye Network Security/Parsers/FireEyeNXEvent.yaml x: 31 contributors (all time) y: 70 lines of code Solutions/GoogleCloudPlatformDNS/Hunting Queries/GCPDNSRareDomains.yaml x: 52 contributors (all time) y: 25 lines of code Solutions/GoogleWorkspaceReports/Parsers/GWorkspaceActivityReports.yaml x: 31 contributors (all time) y: 204 lines of code Solutions/GreyNoiseThreatIntelligence/Data Connectors/GreyNoiseAPISentinelConnector/main.py x: 37 contributors (all time) y: 300 lines of code Solutions/Legacy IOC based Threat Protection/Deprecated Analytic Rules/Dev-0530_July2022.yaml x: 24 contributors (all time) y: 164 lines of code Solutions/Legacy IOC based Threat Protection/Hunting Queries/Dev-0322FileDropActivityNovember2021(ASIMVersion).yaml x: 41 contributors (all time) y: 9 lines of code Solutions/Legacy IOC based Threat Protection/Hunting Queries/NylonTyphoonRegIOCPatterns.yaml x: 54 contributors (all time) y: 91 lines of code Solutions/Lookout Cloud Security Platform for Microsoft Sentinel/Data Connectors/LookoutCSConnector/LookoutCloudSecurityAnamolies/__init__.py x: 50 contributors (all time) y: 340 lines of code Solutions/MailRisk/Data Connectors/models/email.py x: 51 contributors (all time) y: 104 lines of code Solutions/McAfee ePolicy Orchestrator/Parsers/McAfeeEPOEvent.yaml x: 51 contributors (all time) y: 200 lines of code Solutions/MicrosoftPurviewInsiderRiskManagement/Analytic Rules/InsiderRiskSensitiveDataAccessOutsideOrgGeo.yaml x: 79 contributors (all time) y: 57 lines of code Solutions/MimecastSEG/Data Connectors/Models/Enum/__init__.py x: 26 contributors (all time) y: 1 lines of code Solutions/MimecastTTP/Data Connectors/GetTTPAttachment/__init__.py x: 39 contributors (all time) y: 78 lines of code Solutions/MimecastTTP/Data Connectors/Helpers/request_helper.py x: 26 contributors (all time) y: 117 lines of code Solutions/Netskope/Data Connectors/Netskope/AzureFunctionNetskope/run.ps1 x: 60 contributors (all time) y: 388 lines of code Solutions/Okta Single Sign-On/Data Connectors/OktaSingleSign-On/AzureFunctionOktaSSO_V2/AzureFunctionOktaSSO/run.ps1 x: 21 contributors (all time) y: 167 lines of code Solutions/OneLoginIAM/Parsers/OneLogin.yaml x: 38 contributors (all time) y: 589 lines of code Solutions/Qualys VM Knowledgebase/Data Connectors/AzureFunctionQualysKB/run.ps1 x: 77 contributors (all time) y: 262 lines of code Solutions/Rapid7InsightVM/Data Connectors/InsightVMCloudAPISentinelConnector/__init__.py x: 85 contributors (all time) y: 218 lines of code Solutions/Snowflake/Hunting Queries/SnowflakeHighCreditConsumingQueries.yaml x: 61 contributors (all time) y: 26 lines of code Solutions/Vectra AI Stream/Parsers/VectraStream_function.yaml x: 31 contributors (all time) y: 460 lines of code Solutions/Web Session Essentials/Analytic Rules/RequestToPotentiallyHarmfulFileTypes.yaml x: 35 contributors (all time) y: 112 lines of code Solutions/Windows Server DNS/Hunting Queries/DNS_HighPercentNXDomainCount.yaml x: 53 contributors (all time) y: 100 lines of code Solutions/ZeroNetworks/Playbooks/ZeroNetworksConnector/ZeroNetworks-swagger.yaml x: 31 contributors (all time) y: 379 lines of code Solutions/ZoomReports/Data Connectors/ZoomSentinelConnector/__init__.py x: 47 contributors (all time) y: 299 lines of code Tools/Archive-Log-Tool/ArchiveLogsTool-PowerShell/Configure-Long-Term-Retention.ps1 x: 97 contributors (all time) y: 510 lines of code Tools/Create-Azure-Sentinel-Solution/V2/createSolutionV2.ps1 x: 137 contributors (all time) y: 2512 lines of code Tools/Create-Azure-Sentinel-Solution/common/LogAppInsights.ps1 x: 39 contributors (all time) y: 387 lines of code Tools/Playbook-ARM-Template-Generator/src/Playbook_ARM_Template_Generator.ps1 x: 42 contributors (all time) y: 526 lines of code Tools/Sentinel-All-In-One/v2/Scripts/EnableRules.ps1 x: 46 contributors (all time) y: 276 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/ZAP/Total ZAP Count.yaml x: 1 contributors (all time) y: 20 lines of code Solutions/Radiflow/Analytic Rules/RadiflowUnauthorizedCommandInOperationalDevice.yaml x: 1 contributors (all time) y: 33 lines of code Tools/Create-Azure-Sentinel-Solution/createSolution.ps1 x: 104 contributors (all time) y: 1314 lines of code Hunting Queries/AzureActivity/AzureAdministrationFromVPS.yaml x: 80 contributors (all time) y: 3 lines of code Hunting Queries/AzureActivity/Common_Deployed_Resources.yaml x: 89 contributors (all time) y: 3 lines of code Hunting Queries/AzureActivity/Rare_Custom_Script_Extension.yaml x: 69 contributors (all time) y: 3 lines of code Hunting Queries/CommonSecurityLog/B64IPInURL.yaml x: 52 contributors (all time) y: 4 lines of code Hunting Queries/OfficeActivity/MultiTeamBot.yaml x: 78 contributors (all time) y: 4 lines of code Hunting Queries/SecurityEvent/DecoyUserAccountAuthenticationAttempt.yaml x: 54 contributors (all time) y: 4 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventMicrosoftExchangeAdmin365.yaml x: 39 contributors (all time) y: 122 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventAzureAdminActivity.yaml x: 37 contributors (all time) y: 216 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventMicrosoftExchangeAdmin365.yaml x: 39 contributors (all time) y: 191 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionAppGateSDP.yaml x: 55 contributors (all time) y: 158 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCheckPointFirewall.yaml x: 52 contributors (all time) y: 268 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAppGateSDP.yaml x: 60 contributors (all time) y: 232 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCheckPointFirewall.yaml x: 50 contributors (all time) y: 325 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftLinuxSysmon.yaml x: 84 contributors (all time) y: 204 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionzScalerZIA.yaml x: 76 contributors (all time) y: 168 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionNative.yaml x: 28 contributors (all time) y: 73 lines of code Parsers/ASimWebSession/Parsers/ASimWebSessionzScalerZIA.yaml x: 77 contributors (all time) y: 123 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionEmpty.yaml x: 79 contributors (all time) y: 179 lines of code Solutions/CohesitySecurity/Tools/Cohesity_Playbook_ARM_Template_Generator.ps1 x: 26 contributors (all time) y: 445 lines of code Solutions/CohesitySecurity/build_one_solution.ps1 x: 27 contributors (all time) y: 1315 lines of code Solutions/1Password/Analytics Rules/1Password - Manual Account Creation.yaml x: 1 contributors (all time) y: 55 lines of code ASIM/dev/Delete-SentinelFunction/Delete-SentinelFunction.ps1 x: 21 contributors (all time) y: 92 lines of code ASIM/lib/functions/ASIM_LookupDnsQueryType.yaml x: 33 contributors (all time) y: 117 lines of code ASIM/lib/functions/ASIM_LookupHTTPStatusCode.yaml x: 36 contributors (all time) y: 228 lines of code ASIM/lib/functions/ASIM_LookupNetworkProtocol.yaml x: 33 contributors (all time) y: 176 lines of code ASIM/lib/functions/ASIM_ResolveDnsQueryType.yaml x: 43 contributors (all time) y: 120 lines of code ASIM/lib/functions/ASIM_ResolveNetworkProtocol.yaml x: 43 contributors (all time) y: 179 lines of code DataConnectors/AWS-CloudTrail-AzureFunction/AzFunAWSCloudTrailLogsIngestion/__init__.py x: 18 contributors (all time) y: 378 lines of code DataConnectors/AWS-S3-AzureFunction/AzFun-AWS-S3-Ingestion/__init__.py x: 31 contributors (all time) y: 512 lines of code DataConnectors/AWS-S3/Utils/HelperFunctions.ps1 x: 39 contributors (all time) y: 227 lines of code DataConnectors/AzureStorage/GetAzureStorageLogsFunction.cs x: 9 contributors (all time) y: 327 lines of code DataConnectors/Duo Security/AzureFunctionDuoSecurity/run.ps1 x: 41 contributors (all time) y: 250 lines of code DataConnectors/Fluentd-VMSS/plugin/cef_version_0_keys.yaml x: 6 contributors (all time) y: 166 lines of code DataConnectors/Fluentd-VMSS/plugin/out_remote_syslog-as.rb x: 6 contributors (all time) y: 132 lines of code DataConnectors/Fluentd-VMSS/plugin/parser_cef-as.rb x: 6 contributors (all time) y: 203 lines of code DataConnectors/GithubFunction/AzureFunctionGitHub/requirements.psd1 x: 19 contributors (all time) y: 6 lines of code DataConnectors/JumpCloud Single Sign On/AzureFunctionJumpCloud/requirements.psd1 x: 15 contributors (all time) y: 8 lines of code DataConnectors/MCASActivityFunction/AzureFunctionMCASActivity/MCASActivityTimerTrigger/run.ps1 x: 50 contributors (all time) y: 304 lines of code DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/modules/Write-OMSLogfile.ps1 x: 5 contributors (all time) y: 126 lines of code DataConnectors/O365 Data/O365APItoAS-Template/requirements.psd1 x: 5 contributors (all time) y: 6 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Common/ExponentialBackoff.cs x: 7 contributors (all time) y: 35 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Models/AuditInitialReport.cs x: 7 contributors (all time) y: 17 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.Processor/Processor.cs x: 7 contributors (all time) y: 201 lines of code DataConnectors/O365 DataCSharp/Teams.CustomConnector.StorageHandler/StorageHandler.cs x: 22 contributors (all time) y: 113 lines of code DataConnectors/Okta Single Sign-On/AzureFunctionOktaSSO_V2/AzureFunctionOktaSSO/run.ps1 x: 38 contributors (all time) y: 167 lines of code DataConnectors/Qualys VM/AzureFunctionQualysVM/run.ps1 x: 43 contributors (all time) y: 212 lines of code DataConnectors/S3-Lambda/S3toSentinel.ps1 x: 13 contributors (all time) y: 227 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_PowerShell/Template_REST_API_Function_App_PowerShell.ps1 x: 37 contributors (all time) y: 119 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_PowerShell/profile.ps1 x: 6 contributors (all time) y: 18 lines of code DataConnectors/Templates/Connector_REST_API_AzureFunctionApp_template/Template_REST_API_AzureFunction_App_Code/Template_REST_API_Function_App_PowerShell/requirements.psd1 x: 6 contributors (all time) y: 7 lines of code Hunting Queries/Microsoft 365 Defender/Campaigns/fireeye-red-team-tools-HASHs [Nobelium].yaml x: 22 contributors (all time) y: 335 lines of code Hunting Queries/Microsoft 365 Defender/Campaigns/oceanlotus-apt32-files.yaml x: 22 contributors (all time) y: 98 lines of code Hunting Queries/Microsoft 365 Defender/General queries/Baseline Comparison.yaml x: 22 contributors (all time) y: 257 lines of code Hunting Queries/MultipleDataSources/DownloadofNewFileUsingCurl.yaml x: 33 contributors (all time) y: 57 lines of code Hunting Queries/ZoomLogs/HighCPURoom.yaml x: 68 contributors (all time) y: 35 lines of code Parsers/ASimDns/Parsers/ASimDnsCorelightZeek.yaml x: 52 contributors (all time) y: 204 lines of code Parsers/ASimDns/Parsers/vimDnsCiscoUmbrella.yaml x: 37 contributors (all time) y: 108 lines of code Parsers/ASimDns/Parsers/vimDnsCorelightZeek.yaml x: 52 contributors (all time) y: 256 lines of code Parsers/ASimDns/Parsers/vimDnsEmpty.yaml x: 49 contributors (all time) y: 173 lines of code Parsers/ASimDns/Parsers/vimDnsMicrosoftOMS.yaml x: 47 contributors (all time) y: 256 lines of code Parsers/ASimDns/Parsers/vimDnsVectraAI.yaml x: 36 contributors (all time) y: 144 lines of code Parsers/ASimNetworkSession/ASimNetworkSessionV1/NetworkSessionEmpty.yaml x: 33 contributors (all time) y: 143 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionAzureFirewall.yaml x: 44 contributors (all time) y: 99 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCorelightZeek.yaml x: 38 contributors (all time) y: 129 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftLinuxSysmon.yaml x: 66 contributors (all time) y: 120 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionVMConnection.yaml x: 59 contributors (all time) y: 153 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionVectraAI.yaml x: 33 contributors (all time) y: 134 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionAzureNSG.yaml x: 52 contributors (all time) y: 155 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionEmpty.yaml x: 53 contributors (all time) y: 164 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionVectraAI.yaml x: 33 contributors (all time) y: 196 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateLinuxSysmon.yaml x: 35 contributors (all time) y: 171 lines of code Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftSecurityEvents.yaml x: 48 contributors (all time) y: 184 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionSquidProxy.yaml x: 66 contributors (all time) y: 141 lines of code Parsers/ASimWebSession/Parsers/vimWebSessionVectraAI.yaml x: 44 contributors (all time) y: 196 lines of code Playbooks/Resolve-McasInfrequentCountryAlerts/Deploy.ps1 x: 10 contributors (all time) y: 5 lines of code Solutions/AWSAthena/Playbooks/CustomConnector/AWSAthena_FunctionAppConnector/GetQueryResults/__init__.py x: 21 contributors (all time) y: 78 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/sentinel_connector_async.py x: 19 contributors (all time) y: 96 lines of code Solutions/Box/Analytic Rules/BoxBinaryFile.yaml x: 71 contributors (all time) y: 29 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicator/CrowdstrikeFalconAPISentinelConnector/sentinel_connector_async.py x: 33 contributors (all time) y: 95 lines of code Solutions/PaloAltoPrismaCloud/Data Connectors/AzureFunctionPrismaCloud/main.py x: 55 contributors (all time) y: 193 lines of code Solutions/PaloAltoPrismaCloud/Data Connectors/AzureFunctionPrismaCloud/sentinel_connector_async.py x: 42 contributors (all time) y: 101 lines of code Solutions/SAP/template/loggingconfig_DEV.yaml x: 43 contributors (all time) y: 195 lines of code Solutions/SailPointIdentityNow/Data Connectors/SearchEvent/__init__.py x: 34 contributors (all time) y: 179 lines of code Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor/SecurityScorecardFactorSentinelConnector/writers.py x: 22 contributors (all time) y: 188 lines of code Solutions/SentinelOne/Data Connectors/SentinelOneSentinelConnector/__init__.py x: 25 contributors (all time) y: 173 lines of code Solutions/SlackAudit/Data Connectors/SlackAuditAPISentinelConnector/__init__.py x: 22 contributors (all time) y: 278 lines of code Solutions/Snowflake/Data Connectors/AzureFunctionSnowflake/sentinel_connector.py x: 39 contributors (all time) y: 103 lines of code Solutions/Synack/Integrations/AzureFunctionSynack/synack-service.js x: 41 contributors (all time) y: 111 lines of code Solutions/Synack/Integrations/AzureFunctionSynack/sync-service.js x: 41 contributors (all time) y: 220 lines of code Solutions/TenableIO/Data Connectors/TenableGenerateJobStats/__init__.py x: 16 contributors (all time) y: 136 lines of code Tools/ArcSight-Data-Migration/lacat-opt.py x: 23 contributors (all time) y: 152 lines of code Tools/Az.SecurityInsights-Samples/Alert Rules/Import GitHub YAML rules/ImportGitHubYAMLrules.ps1 x: 27 contributors (all time) y: 158 lines of code Tools/AzureDataExplorer/CreateTables_ADX/Create-LA-Tables-ADX.ps1 x: 16 contributors (all time) y: 318 lines of code Tools/AzureDataExplorer/Migrate-LA-to-ADX.ps1 x: 48 contributors (all time) y: 613 lines of code Tools/AzureDataExplorer/Pipeline/Migrate-LA-to-ADX-Pipeline.ps1 x: 16 contributors (all time) y: 611 lines of code Tools/CustomLogsIngestion-DCE-DCR/src/Send-AzMonitorCustomLogs.ps1 x: 28 contributors (all time) y: 190 lines of code Tools/ParameterizedFunction/AuditEventDataLookup_Func.ps1 x: 10 contributors (all time) y: 136 lines of code Tools/PowerShell/Add-PlaybooksToSentinel/Add-PlaybooksToSentinel.ps1 x: 7 contributors (all time) y: 136 lines of code Tools/RDAP/RDAPQuery/RDAPQuery/LogAnalytics.cs x: 18 contributors (all time) y: 159 lines of code Tools/SIEM-Data-Migration/installTools.ps1 x: 17 contributors (all time) y: 7 lines of code Tools/Sample-Data-Ingest-Tool/SampleDataIngestTool/AppConfig.cs x: 5 contributors (all time) y: 33 lines of code Tools/UploadToBlobLookupTables/UploadToBlobLookupTables/UploadToBlobLookupTables/run.ps1 x: 5 contributors (all time) y: 83 lines of code Tutorials/Microsoft 365 Defender/Webcasts/Airlift 2021 - Lets Invoke.csl x: 19 contributors (all time) y: 415 lines of code Watchlists/UpdateCloudIPs/AzureFunctionUpdateCloudIPs/UpdateCloudIPs/run.ps1 x: 21 contributors (all time) y: 529 lines of code Parsers/ASimAuthentication/Parsers/ASimAuthenticationCiscoIse.yaml x: 1 contributors (all time) y: 257 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationCiscoIse.yaml x: 1 contributors (all time) y: 352 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/AS_poller.py x: 1 contributors (all time) y: 2 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/DS_api.py x: 1 contributors (all time) y: 98 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/DS_poller.py x: 1 contributors (all time) y: 140 lines of code Solutions/Digital Shadows/Data Connectors/Digital shadows/DigitalShadowsConnectorAzureFunction/state_serializer.py x: 1 contributors (all time) y: 73 lines of code Detections/AWSGuardDuty/AWS_GuardDuty_template.YAML x: 3 contributors (all time) y: 4 lines of code
3543.0
lines of code
  min: 1.0
  average: 63.97
  25th percentile: 23.0
  median: 37.0
  75th percentile: 69.0
  max: 3543.0
0 159.0
contributors (all time)
min: 1.0 | average: 41.06 | 25th percentile: 22.0 | median: 34.0 | 75th percentile: 55.0 | max: 159.0

File Size vs. Commits (30 days): 340 points

Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CloudAppEvents_Updated.yaml x: 15 commits (30d) y: 72 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DeviceNetworkEvents_Updated.yaml x: 14 commits (30d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_AzureActivity.yaml x: 20 commits (30d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_OfficeActivity.yaml x: 20 commits (30d) y: 58 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 20 commits (30d) y: 75 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureFirewall.yaml x: 14 commits (30d) y: 69 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureKeyVault.yaml x: 15 commits (30d) y: 61 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CloudAppEvents_Updated.yaml x: 14 commits (30d) y: 4 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CustomSecurityLog.yaml x: 16 commits (30d) y: 42 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_OfficeActivity.yaml x: 21 commits (30d) y: 64 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_Workday_Updated.yaml x: 15 commits (30d) y: 53 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/imDns_DomainEntity_DnsEvents.yaml x: 21 commits (30d) y: 83 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 3 commits (30d) y: 78 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml x: 3 commits (30d) y: 39 lines of code DataConnectors/AWS-S3/Utils/CommonAwsPolicies.ps1 x: 13 commits (30d) y: 224 lines of code Solutions/AtlassianConfluenceAudit/Parsers/ConfluenceAudit.yaml x: 11 commits (30d) y: 76 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAgentPoolCreatedDeleted.yaml x: 11 commits (30d) y: 57 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAuditStreamDisabled.yaml x: 11 commits (30d) y: 37 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOSecretNotSecured.yaml x: 11 commits (30d) y: 44 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml x: 11 commits (30d) y: 27 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewAgentPoolCreated.yaml x: 11 commits (30d) y: 6 lines of code Solutions/AzureDevOpsAuditing/Parsers/ADOAuditLogs.yaml x: 12 commits (30d) y: 17 lines of code Solutions/ImpervaCloudWAF/Data Connectors/ImpervaWAFCloudSentinelConnector/__init__.py x: 16 commits (30d) y: 221 lines of code Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit logging disabled.yaml x: 13 commits (30d) y: 68 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AnomalousUserAppSigninLocationIncrease-detection.yaml x: 15 commits (30d) y: 38 lines of code Solutions/Microsoft Entra ID/Analytic Rules/DistribPassCrackAttempt.yaml x: 6 commits (30d) y: 60 lines of code Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml x: 10 commits (30d) y: 91 lines of code Solutions/QualysVM/Data Connectors/AzureFunctionQualysVM_V2/run.ps1 x: 4 commits (30d) y: 285 lines of code Solutions/QualysVM/Parsers/QualysHostDetection.yaml x: 5 commits (30d) y: 88 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_EvidenceOfMimikatzDCShadowAttack.yaml x: 10 commits (30d) y: 23 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_KerberoskrbtgtAccount.yaml x: 10 commits (30d) y: 32 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Failed_Logons.yaml x: 10 commits (30d) y: 53 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_RBAC_Changes.yaml x: 10 commits (30d) y: 61 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CommonSecurityLog.yaml x: 12 commits (30d) y: 50 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DnsEvents.yaml x: 18 commits (30d) y: 74 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_EmailUrlInfo_Updated.yaml x: 12 commits (30d) y: 66 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_PaloAlto.yaml x: 12 commits (30d) y: 108 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_Syslog.yaml x: 19 commits (30d) y: 73 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_imWebSession.yaml x: 18 commits (30d) y: 57 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/FileHashEntity_DeviceFileEvents_Updated.yaml x: 12 commits (30d) y: 38 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_imNetworkSession.yaml x: 14 commits (30d) y: 106 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/URLEntity_PaloAlto.yaml x: 12 commits (30d) y: 79 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/function_app.py x: 14 commits (30d) y: 80 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/message_factory.py x: 14 commits (30d) y: 526 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/withsecure_client.py x: 14 commits (30d) y: 146 lines of code Tools/Create-Azure-Sentinel-Solution/arm-ttk/run-arm-ttk-in-automation.ps1 x: 6 commits (30d) y: 45 lines of code Tools/Create-Azure-Sentinel-Solution/common/commonFunctions.ps1 x: 20 commits (30d) y: 3350 lines of code Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 x: 19 commits (30d) y: 921 lines of code DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 x: 3 commits (30d) y: 299 lines of code DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 x: 3 commits (30d) y: 97 lines of code DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 x: 3 commits (30d) y: 270 lines of code DataConnectors/AWS-S3/Utils/AwsPoliciesUpdate.ps1 x: 3 commits (30d) y: 125 lines of code DataConnectors/AWS-S3/Utils/AwsSentinelTag.ps1 x: 3 commits (30d) y: 15 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCDNLogsSetup/GCPCDNLogSetup.tf x: 4 commits (30d) y: 86 lines of code Detections/ASimProcess/SdeletedeployedviaGPOandrunrecursively(ASIMVersion).yaml x: 4 commits (30d) y: 35 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Email bombing.yaml x: 3 commits (30d) y: 12 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Phish/Possible device code phishing attempts.yaml x: 3 commits (30d) y: 47 lines of code Playbooks/Isolate-AzVM/Convert-SnapshotsToVHD.ps1 x: 4 commits (30d) y: 195 lines of code Solutions/Armis/Data Connectors/ArmisDevice/ArmisDeviceSentinelConnector/__init__.py x: 3 commits (30d) y: 456 lines of code Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ/main.py x: 3 commits (30d) y: 467 lines of code Solutions/Commvault Security IQ/Tools/AssignLogicAppRoles.ps1 x: 4 commits (30d) y: 67 lines of code Solutions/Commvault Security IQ/Tools/Setup-CommvaultAutomation.ps1 x: 4 commits (30d) y: 222 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_disk.yaml x: 4 commits (30d) y: 968 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_iface.yaml x: 4 commits (30d) y: 164 lines of code Solutions/Corelight/Parsers/corelight_files.yaml x: 4 commits (30d) y: 137 lines of code Solutions/Corelight/Parsers/corelight_http.yaml x: 4 commits (30d) y: 205 lines of code Solutions/Corelight/Parsers/corelight_intel.yaml x: 4 commits (30d) y: 101 lines of code Solutions/Corelight/Parsers/corelight_notice.yaml x: 4 commits (30d) y: 146 lines of code Solutions/Corelight/Parsers/corelight_smb_files.yaml x: 4 commits (30d) y: 125 lines of code Solutions/Corelight/Parsers/corelight_software.yaml x: 4 commits (30d) y: 74 lines of code Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml x: 7 commits (30d) y: 64 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopHttpStarter/__init__.py x: 3 commits (30d) y: 67 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopSentinelActivity/sentinel.py x: 3 commits (30d) y: 197 lines of code Solutions/GoogleCloudPlatformDNS/Parsers/GCPCloudDNS.yaml x: 3 commits (30d) y: 131 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml x: 7 commits (30d) y: 81 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml x: 7 commits (30d) y: 4 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml x: 7 commits (30d) y: 52 lines of code Solutions/Jamf Protect/Parsers/JamfProtectAlerts.yaml x: 7 commits (30d) y: 20 lines of code Solutions/Jamf Protect/Parsers/JamfProtectTelemetry.yaml x: 7 commits (30d) y: 740 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/CollectExchSecIns.ps1 x: 3 commits (30d) y: 3543 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Attachment.yaml x: 4 commits (30d) y: 54 lines of code Solutions/Team Cymru Scout/Parsers/CymruScoutIP.yaml x: 7 commits (30d) y: 92 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/timer_trigger/__init__.py x: 3 commits (30d) y: 104 lines of code DataConnectors/Syslog/Forwarder_AMA_installer.py x: 2 commits (30d) y: 248 lines of code Solutions/Azure Activity/Hunting Queries/Machine_Learning_Creation.yaml x: 2 commits (30d) y: 44 lines of code Solutions/Azure Web Application Firewall (WAF)/Analytic Rules/App-GW-WAF-SQLiDetection.yaml x: 2 commits (30d) y: 56 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/main.py x: 2 commits (30d) y: 147 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/models.py x: 2 commits (30d) y: 86 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/utils.py x: 2 commits (30d) y: 276 lines of code Solutions/IPinfo/Data Connectors/ASN/AzureFunctionIPinfoASN/constants.py x: 2 commits (30d) y: 71 lines of code Solutions/IPinfo/Data Connectors/RIRWHOIS/AzureFunctionIPinfoRIRWHOIS/constants.py x: 2 commits (30d) y: 99 lines of code Solutions/Proofpoint On demand(POD) Email Security/Data Connectors/ProofpointSentinelConnector/__init__.py x: 2 commits (30d) y: 165 lines of code
3543.0
lines of code
  min: 1.0
  average: 108.09
  25th percentile: 38.0
  median: 55.5
  75th percentile: 82.0
  max: 3543.0
0 21.0
commits (30d)
min: 2.0 | average: 6.94 | 25th percentile: 3.0 | median: 4.0 | 75th percentile: 11.0 | max: 21.0

File Size vs. Contributors (30 days): 340 points

Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CloudAppEvents_Updated.yaml x: 7 contributors (30d) y: 72 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DeviceNetworkEvents_Updated.yaml x: 7 contributors (30d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_AzureActivity.yaml x: 8 contributors (30d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_OfficeActivity.yaml x: 8 contributors (30d) y: 58 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 8 contributors (30d) y: 75 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureFirewall.yaml x: 7 contributors (30d) y: 69 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CloudAppEvents_Updated.yaml x: 7 contributors (30d) y: 4 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 2 contributors (30d) y: 78 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml x: 2 contributors (30d) y: 39 lines of code DataConnectors/AWS-S3/Utils/CommonAwsPolicies.ps1 x: 6 contributors (30d) y: 224 lines of code Solutions/AtlassianConfluenceAudit/Parsers/ConfluenceAudit.yaml x: 6 contributors (30d) y: 76 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAgentPoolCreatedDeleted.yaml x: 5 contributors (30d) y: 57 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAuditStreamDisabled.yaml x: 5 contributors (30d) y: 37 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOSecretNotSecured.yaml x: 5 contributors (30d) y: 44 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml x: 5 contributors (30d) y: 72 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml x: 5 contributors (30d) y: 27 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewAgentPoolCreated.yaml x: 5 contributors (30d) y: 6 lines of code Solutions/ImpervaCloudWAF/Data Connectors/ImpervaWAFCloudSentinelConnector/__init__.py x: 7 contributors (30d) y: 221 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AnomalousUserAppSigninLocationIncrease-detection.yaml x: 6 contributors (30d) y: 38 lines of code Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml x: 6 contributors (30d) y: 91 lines of code Solutions/QualysVM/Data Connectors/AzureFunctionQualysVM_V2/run.ps1 x: 3 contributors (30d) y: 285 lines of code Solutions/QualysVM/Parsers/QualysHostDetection.yaml x: 4 contributors (30d) y: 88 lines of code Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml x: 6 contributors (30d) y: 65 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CommonSecurityLog.yaml x: 6 contributors (30d) y: 50 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_PaloAlto.yaml x: 6 contributors (30d) y: 108 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_imNetworkSession.yaml x: 7 contributors (30d) y: 106 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/message_factory.py x: 7 contributors (30d) y: 526 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/withsecure_client.py x: 7 contributors (30d) y: 146 lines of code Tools/Create-Azure-Sentinel-Solution/common/commonFunctions.ps1 x: 11 contributors (30d) y: 3350 lines of code Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 x: 10 contributors (30d) y: 921 lines of code DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 x: 2 contributors (30d) y: 299 lines of code DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 x: 2 contributors (30d) y: 97 lines of code DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 x: 2 contributors (30d) y: 270 lines of code DataConnectors/AWS-S3/Utils/AwsPoliciesUpdate.ps1 x: 2 contributors (30d) y: 125 lines of code DataConnectors/AWS-S3/Utils/AwsSentinelTag.ps1 x: 2 contributors (30d) y: 15 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Email bombing.yaml x: 2 contributors (30d) y: 12 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Phish/Possible device code phishing attempts.yaml x: 2 contributors (30d) y: 47 lines of code Playbooks/Isolate-AzVM/Convert-SnapshotsToVHD.ps1 x: 2 contributors (30d) y: 195 lines of code Solutions/Armis/Data Connectors/ArmisDevice/ArmisDeviceSentinelConnector/__init__.py x: 2 contributors (30d) y: 456 lines of code Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ/main.py x: 2 contributors (30d) y: 467 lines of code Solutions/Commvault Security IQ/Tools/AssignLogicAppRoles.ps1 x: 2 contributors (30d) y: 67 lines of code Solutions/Commvault Security IQ/Tools/Setup-CommvaultAutomation.ps1 x: 2 contributors (30d) y: 222 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_disk.yaml x: 2 contributors (30d) y: 968 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_iface.yaml x: 2 contributors (30d) y: 164 lines of code Solutions/Corelight/Parsers/corelight_files.yaml x: 2 contributors (30d) y: 137 lines of code Solutions/Corelight/Parsers/corelight_http.yaml x: 2 contributors (30d) y: 205 lines of code Solutions/Corelight/Parsers/corelight_intel.yaml x: 2 contributors (30d) y: 101 lines of code Solutions/Corelight/Parsers/corelight_notice.yaml x: 2 contributors (30d) y: 146 lines of code Solutions/CyberArkAudit/Data Connectors/CyberArkAuditConnector/exporter.py x: 4 contributors (30d) y: 45 lines of code Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml x: 3 contributors (30d) y: 64 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml x: 3 contributors (30d) y: 81 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml x: 3 contributors (30d) y: 4 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml x: 3 contributors (30d) y: 52 lines of code Solutions/Jamf Protect/Parsers/JamfProtectAlerts.yaml x: 3 contributors (30d) y: 20 lines of code Solutions/Jamf Protect/Parsers/JamfProtectTelemetry.yaml x: 3 contributors (30d) y: 740 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/CollectExchSecIns.ps1 x: 2 contributors (30d) y: 3543 lines of code Solutions/Team Cymru Scout/Parsers/CymruScoutIP.yaml x: 3 contributors (30d) y: 92 lines of code DataConnectors/Syslog/Forwarder_AMA_installer.py x: 2 contributors (30d) y: 248 lines of code
3543.0
lines of code
  min: 1.0
  average: 108.09
  25th percentile: 38.0
  median: 55.5
  75th percentile: 82.0
  max: 3543.0
0 11.0
contributors (30d)
min: 2.0 | average: 3.61 | 25th percentile: 2.0 | median: 2.0 | 75th percentile: 5.0 | max: 11.0

File Size vs. Commits (90 days): 1320 points

Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CloudAppEvents_Updated.yaml x: 15 commits (90d) y: 72 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DeviceNetworkEvents_Updated.yaml x: 14 commits (90d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_AzureActivity.yaml x: 20 commits (90d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_OfficeActivity.yaml x: 20 commits (90d) y: 58 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 20 commits (90d) y: 75 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureFirewall.yaml x: 14 commits (90d) y: 69 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureKeyVault.yaml x: 15 commits (90d) y: 61 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CloudAppEvents_Updated.yaml x: 14 commits (90d) y: 4 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CustomSecurityLog.yaml x: 16 commits (90d) y: 42 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_OfficeActivity.yaml x: 21 commits (90d) y: 64 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_Workday_Updated.yaml x: 15 commits (90d) y: 53 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/imDns_DomainEntity_DnsEvents.yaml x: 21 commits (90d) y: 83 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 3 commits (90d) y: 78 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml x: 3 commits (90d) y: 39 lines of code DataConnectors/AWS-S3/Utils/CommonAwsPolicies.ps1 x: 32 commits (90d) y: 224 lines of code Solutions/AtlassianConfluenceAudit/Parsers/ConfluenceAudit.yaml x: 11 commits (90d) y: 76 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAgentPoolCreatedDeleted.yaml x: 11 commits (90d) y: 57 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAuditStreamDisabled.yaml x: 11 commits (90d) y: 37 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOSecretNotSecured.yaml x: 11 commits (90d) y: 44 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml x: 11 commits (90d) y: 27 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewAgentPoolCreated.yaml x: 11 commits (90d) y: 6 lines of code Solutions/AzureDevOpsAuditing/Parsers/ADOAuditLogs.yaml x: 12 commits (90d) y: 17 lines of code Solutions/ImpervaCloudWAF/Data Connectors/ImpervaWAFCloudSentinelConnector/__init__.py x: 16 commits (90d) y: 221 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AnomalousUserAppSigninLocationIncrease-detection.yaml x: 15 commits (90d) y: 38 lines of code Solutions/Microsoft Entra ID/Analytic Rules/DistribPassCrackAttempt.yaml x: 6 commits (90d) y: 60 lines of code Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml x: 10 commits (90d) y: 91 lines of code Solutions/QualysVM/Data Connectors/AzureFunctionQualysVM_V2/run.ps1 x: 5 commits (90d) y: 285 lines of code Solutions/QualysVM/Parsers/QualysHostDetection.yaml x: 5 commits (90d) y: 88 lines of code Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml x: 45 commits (90d) y: 65 lines of code Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxApplicationPrivilegeEscalationOrChange.yaml x: 24 commits (90d) y: 30 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_EvidenceOfMimikatzDCShadowAttack.yaml x: 21 commits (90d) y: 23 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_KerberoskrbtgtAccount.yaml x: 21 commits (90d) y: 32 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Failed_Logons.yaml x: 21 commits (90d) y: 53 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Operations_Critical_Notifications_.yaml x: 22 commits (90d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CommonSecurityLog.yaml x: 12 commits (90d) y: 50 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DnsEvents.yaml x: 18 commits (90d) y: 74 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_EmailUrlInfo_Updated.yaml x: 12 commits (90d) y: 66 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_PaloAlto.yaml x: 12 commits (90d) y: 108 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_Syslog.yaml x: 19 commits (90d) y: 73 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_imWebSession.yaml x: 18 commits (90d) y: 57 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/FileHashEntity_DeviceFileEvents_Updated.yaml x: 12 commits (90d) y: 38 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_imNetworkSession.yaml x: 14 commits (90d) y: 106 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/URLEntity_PaloAlto.yaml x: 12 commits (90d) y: 79 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/message_factory.py x: 15 commits (90d) y: 526 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/withsecure_client.py x: 15 commits (90d) y: 146 lines of code Tools/Create-Azure-Sentinel-Solution/arm-ttk/run-arm-ttk-in-automation.ps1 x: 6 commits (90d) y: 45 lines of code Tools/Create-Azure-Sentinel-Solution/common/commonFunctions.ps1 x: 41 commits (90d) y: 3350 lines of code Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 x: 47 commits (90d) y: 921 lines of code DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 x: 20 commits (90d) y: 299 lines of code DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 x: 20 commits (90d) y: 97 lines of code DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 x: 20 commits (90d) y: 270 lines of code DataConnectors/AWS-S3/Utils/AwsPoliciesUpdate.ps1 x: 20 commits (90d) y: 125 lines of code DataConnectors/AWS-S3/Utils/AwsSentinelTag.ps1 x: 20 commits (90d) y: 15 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCDNLogsSetup/GCPCDNLogSetup.tf x: 13 commits (90d) y: 86 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPIAMCCPLogsSetup/GCPIAMLOGS.tf x: 17 commits (90d) y: 82 lines of code Detections/ASimProcess/SdeletedeployedviaGPOandrunrecursively(ASIMVersion).yaml x: 9 commits (90d) y: 35 lines of code Hunting Queries/Microsoft 365 Defender/Defense evasion/suspicious-base64-encoded-registry-keys.yaml x: 19 commits (90d) y: 26 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Email sender IP address Geo location information.yaml x: 15 commits (90d) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Email bombing.yaml x: 16 commits (90d) y: 12 lines of code Playbooks/Isolate-AzVM/Convert-SnapshotsToVHD.ps1 x: 11 commits (90d) y: 195 lines of code Playbooks/Isolate-AzVM/Set-ManagedIdentity.ps1 x: 11 commits (90d) y: 92 lines of code Solutions/AIShield AI Security Monitoring/Analytic Rules/BIIDetectionVulDetection.yaml x: 17 commits (90d) y: 41 lines of code Solutions/AIShield AI Security Monitoring/Parsers/Guardian.yaml x: 23 commits (90d) y: 27 lines of code Solutions/Armis/Data Connectors/ArmisDevice/ArmisDeviceSentinelConnector/__init__.py x: 24 commits (90d) y: 456 lines of code Solutions/AtlassianConfluenceAudit/Data Connectors/AtlassianConfluenceAuditDataConnector/ConfluenceAuditAPISentinelConnector/__init__.py x: 18 commits (90d) y: 115 lines of code Solutions/AtlassianConfluenceAudit/Data Connectors/AtlassianConfluenceAuditDataConnector/ConfluenceAuditAPISentinelConnector/state_manager.py x: 18 commits (90d) y: 18 lines of code Solutions/Azure Activity/Analytic Rules/Machine_Learning_Creation.yaml x: 27 commits (90d) y: 53 lines of code Solutions/Commvault Security IQ/Analytic Rules/Data_Alert.yaml x: 19 commits (90d) y: 33 lines of code Solutions/Commvault Security IQ/Analytic Rules/User_Alert.yaml x: 22 commits (90d) y: 35 lines of code Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ/main.py x: 20 commits (90d) y: 467 lines of code Solutions/Commvault Security IQ/Tools/AssignLogicAppRoles.ps1 x: 17 commits (90d) y: 67 lines of code Solutions/Commvault Security IQ/Tools/Setup-CommvaultAutomation.ps1 x: 17 commits (90d) y: 222 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_disk.yaml x: 10 commits (90d) y: 968 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_iface.yaml x: 10 commits (90d) y: 164 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_memory.yaml x: 10 commits (90d) y: 63 lines of code Solutions/Corelight/Parsers/corelight_files.yaml x: 11 commits (90d) y: 137 lines of code Solutions/Corelight/Parsers/corelight_http.yaml x: 11 commits (90d) y: 205 lines of code Solutions/Corelight/Parsers/corelight_intel.yaml x: 10 commits (90d) y: 101 lines of code Solutions/Corelight/Parsers/corelight_notice.yaml x: 10 commits (90d) y: 146 lines of code Solutions/Corelight/Parsers/corelight_smb_files.yaml x: 10 commits (90d) y: 125 lines of code Solutions/Corelight/Parsers/corelight_smtp.yaml x: 10 commits (90d) y: 129 lines of code Solutions/Corelight/Parsers/corelight_software.yaml x: 10 commits (90d) y: 74 lines of code Solutions/Corelight/Parsers/corelight_suri_aggregations.yaml x: 13 commits (90d) y: 64 lines of code Solutions/Google Apigee/Parsers/ApigeeXV2.yaml x: 17 commits (90d) y: 43 lines of code Solutions/GoogleCloudPlatformDNS/Parsers/GCPCloudDNS.yaml x: 23 commits (90d) y: 131 lines of code Solutions/IllumioSaaS/Data Connectors/CommonCode/constants.py x: 23 commits (90d) y: 45 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml x: 9 commits (90d) y: 81 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml x: 9 commits (90d) y: 4 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml x: 9 commits (90d) y: 52 lines of code Solutions/Jamf Protect/Parsers/JamfProtectAlerts.yaml x: 9 commits (90d) y: 20 lines of code Solutions/Jamf Protect/Parsers/JamfProtectNetworkTraffic.yaml x: 9 commits (90d) y: 61 lines of code Solutions/Jamf Protect/Parsers/JamfProtectTelemetry.yaml x: 9 commits (90d) y: 740 lines of code Solutions/Microsoft Defender XDR/Hunting Queries/Email Queries/Hunting/Email bombing.yaml x: 17 commits (90d) y: 12 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SuspiciousServicePrincipalcreationactivity.yaml x: 15 commits (90d) y: 97 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/CollectExchSecIns.ps1 x: 19 commits (90d) y: 3543 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/ExchangeOnlinePermSetup.ps1 x: 16 commits (90d) y: 36 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Parsers/ExchangeAdminAuditLogs.yaml x: 16 commits (90d) y: 65 lines of code Solutions/Mimecast/Analytic Rules/MimecastAudit/Mimecast_Audit.yaml x: 18 commits (90d) y: 53 lines of code Solutions/MimecastSEG/Analytic Rules/MimecastSIEM_Attachment.yaml x: 10 commits (90d) y: 54 lines of code Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-SigninsMultipleCountries.yaml x: 25 commits (90d) y: 41 lines of code Solutions/SecurityBridge App/Parsers/SecurityBridgeLogs.yaml x: 18 commits (90d) y: 33 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/configurations.py x: 16 commits (90d) y: 117 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/timer_trigger/__init__.py x: 16 commits (90d) y: 104 lines of code Summary rules/DNS/ZscalarDNSEventsIPSummary.yaml x: 16 commits (90d) y: 27 lines of code DataConnectors/Syslog/Forwarder_AMA_installer.py x: 17 commits (90d) y: 248 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/main.py x: 14 commits (90d) y: 147 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/models.py x: 14 commits (90d) y: 86 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/utils.py x: 14 commits (90d) y: 276 lines of code Solutions/IPinfo/Data Connectors/ASN/AzureFunctionIPinfoASN/constants.py x: 14 commits (90d) y: 71 lines of code Solutions/Microsoft 365/Analytic Rules/MailItemsAccessedTimeSeries.yaml x: 13 commits (90d) y: 80 lines of code Solutions/Proofpoint On demand(POD) Email Security/Data Connectors/ProofpointSentinelConnector/__init__.py x: 13 commits (90d) y: 165 lines of code DataConnectors/AWS-S3/CloudWatchPushBasedLambdaFunction.py x: 4 commits (90d) y: 48 lines of code DataConnectors/M365Defender-VulnerabilityManagement/maintenance/deployLatestFunctionPackage.ps1 x: 4 commits (90d) y: 7 lines of code Detections/MultipleDataSources/AnomalousIPUsageFollowedByTeamsAction.yaml x: 3 commits (90d) y: 128 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Attachment/ATP policy status check.yaml x: 3 commits (90d) y: 27 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/MDO daily detection summary report.yaml x: 3 commits (90d) y: 65 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Mailflow/Detections by detection methods.yaml x: 3 commits (90d) y: 46 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Phishing Email Url Redirector.yaml x: 3 commits (90d) y: 6 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEvent.yaml x: 4 commits (90d) y: 63 lines of code Parsers/ASimAuditEvent/Parsers/imAuditEvent.yaml x: 4 commits (90d) y: 93 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventNative.yaml x: 4 commits (90d) y: 103 lines of code Parsers/ASimAuthentication/Parsers/imAuthentication.yaml x: 4 commits (90d) y: 115 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoASA.yaml x: 5 commits (90d) y: 461 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoASA.yaml x: 5 commits (90d) y: 590 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async.py x: 4 commits (90d) y: 193 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async_v2.py x: 4 commits (90d) y: 230 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/utils.py x: 4 commits (90d) y: 135 lines of code Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/UserAgentSearch_log4j.yaml x: 5 commits (90d) y: 101 lines of code Solutions/BloodHound Enterprise/Data Connectors/handler.go x: 3 commits (90d) y: 172 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/bloodhound/client.go x: 3 commits (90d) y: 200 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/connector/main.go x: 3 commits (90d) y: 597 lines of code Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CrowdstrikeFalconAPISentinelConn/QueueTriggerCS/__init__.py x: 4 commits (90d) y: 284 lines of code Solutions/CyberArkAudit/Data Connectors/CyberArkAuditConnector/audit.py x: 3 commits (90d) y: 165 lines of code Solutions/CyberArkEPM/DataConnectors/CyberArkEPMSentinelConnector/__init__.py x: 5 commits (90d) y: 160 lines of code Solutions/Dragos/Parsers/DragosPushNotificationsToSentinel.yaml x: 4 commits (90d) y: 41 lines of code Solutions/Dragos/Parsers/DragosSeverityToSentinelSeverity.yaml x: 4 commits (90d) y: 19 lines of code Solutions/IllumioSaaS/Data Connectors/TimedApiFunctionApp/api_response.py x: 11 commits (90d) y: 179 lines of code Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml x: 4 commits (90d) y: 79 lines of code Solutions/Microsoft Entra ID/Analytic Rules/MFARejectedbyUser.yaml x: 3 commits (90d) y: 85 lines of code Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector/__init__.py x: 3 commits (90d) y: 239 lines of code Solutions/SentinelOne/Parsers/SentinelOne.yaml x: 3 commits (90d) y: 651 lines of code Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 x: 9 commits (90d) y: 292 lines of code Tools/Create-Azure-Sentinel-Solution/common/get-ccp-details.ps1 x: 9 commits (90d) y: 362 lines of code Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 x: 9 commits (90d) y: 106 lines of code ASIM/dev/ASimYaml2ARM/KqlFuncYaml2Arm.py x: 1 commits (90d) y: 219 lines of code ASIM/dev/Parser YAML templates/ASimAlertEventTemplate.yaml x: 1 commits (90d) y: 30 lines of code ASIM/dev/Parser YAML templates/vimAlertEventTemplate.yaml x: 1 commits (90d) y: 82 lines of code ASIM/dev/Parser YAML templates/vimAuthenticationTemplate.yaml x: 1 commits (90d) y: 95 lines of code ASIM/dev/Parser YAML templates/vimDhcpEventTemplate.yaml x: 1 commits (90d) y: 62 lines of code ASIM/lib/functions/ASIM_FillNull.yaml x: 1 commits (90d) y: 26 lines of code DataConnectors/AWS-S3/CloudWatchLambdaFunction.py x: 1 commits (90d) y: 47 lines of code DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion/__init__.py x: 1 commits (90d) y: 334 lines of code DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 x: 1 commits (90d) y: 276 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashEventsBatcher.rb x: 2 commits (90d) y: 115 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/version.rb x: 2 commits (90d) y: 9 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec x: 2 commits (90d) y: 19 lines of code Detections/CommonSecurityLog/MultiVendor-PossibleDGAContacts.yaml x: 1 commits (90d) y: 132 lines of code Detections/SecurityAlert/AVSpringShell.yaml x: 1 commits (90d) y: 5 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventMicrosoftDefenderXDR.yaml x: 1 commits (90d) y: 174 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventSentinelOneSingularity.yaml x: 1 commits (90d) y: 113 lines of code Parsers/ASimAlertEvent/Parsers/vimAlertEventMicrosoftDefenderXDR.yaml x: 1 commits (90d) y: 228 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventIllumioSaaSCore.yaml x: 1 commits (90d) y: 375 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventInfobloxBloxOne.yaml x: 1 commits (90d) y: 143 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventIllumioSaaSCore.yaml x: 1 commits (90d) y: 434 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml x: 1 commits (90d) y: 396 lines of code Parsers/ASimDns/Parsers/vimDnsInfobloxBloxOne.yaml x: 1 commits (90d) y: 285 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml x: 1 commits (90d) y: 103 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionIllumioSaaSCore.yaml x: 1 commits (90d) y: 306 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionIllumioSaaSCore.yaml x: 1 commits (90d) y: 385 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/__init__.py x: 1 commits (90d) y: 340 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/utils.py x: 1 commits (90d) y: 205 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/AlertsGraphStatisticsDetails/bitsight_statistics.py x: 1 commits (90d) y: 473 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/BreachesDetails/bitsight_breaches.py x: 1 commits (90d) y: 189 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/CompaniesDetails/bitsight_companies.py x: 1 commits (90d) y: 248 lines of code Solutions/Box/Parsers/BoxEvents.yaml x: 2 commits (90d) y: 320 lines of code Solutions/Cloudflare/Data Connectors/AzureFunctionCloudflare/main.py x: 1 commits (90d) y: 160 lines of code Solutions/Microsoft Business Applications/Parsers/MSBizAppsOrgSettings.yaml x: 1 commits (90d) y: 478 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/utils.py x: 1 commits (90d) y: 751 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/sentinel.py x: 1 commits (90d) y: 256 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/utils.py x: 1 commits (90d) y: 565 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/MimecastCI/mimecast_ci_to_sentinel.py x: 1 commits (90d) y: 553 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/sentinel.py x: 1 commits (90d) y: 318 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/utils.py x: 1 commits (90d) y: 628 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/SharedCode/utils.py x: 1 commits (90d) y: 625 lines of code Solutions/Mimecast/Data Connectors/MimecastTTP/SharedCode/utils.py x: 1 commits (90d) y: 733 lines of code Solutions/Sophos XG Firewall/Analytic Rules/ExcessiveAmountofDeniedConnectionsfromASingleSource.yaml x: 2 commits (90d) y: 31 lines of code Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml x: 2 commits (90d) y: 80 lines of code Solutions/Tomcat/Analytic Rules/TomcatPutAndGetFileFromSameIP.yaml x: 2 commits (90d) y: 44 lines of code
3543.0
lines of code
  min: 1.0
  average: 77.05
  25th percentile: 30.0
  median: 41.0
  75th percentile: 74.75
  max: 3543.0
0 47.0
commits (90d)
min: 1.0 | average: 5.36 | 25th percentile: 1.0 | median: 3.0 | 75th percentile: 10.0 | max: 47.0

File Size vs. Contributors (90 days): 1320 points

Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CloudAppEvents_Updated.yaml x: 7 contributors (90d) y: 72 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_DeviceNetworkEvents_Updated.yaml x: 7 contributors (90d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_AzureActivity.yaml x: 8 contributors (90d) y: 55 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_OfficeActivity.yaml x: 8 contributors (90d) y: 58 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/EmailEntity_SecurityEvent.yaml x: 8 contributors (90d) y: 75 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_AzureFirewall.yaml x: 7 contributors (90d) y: 69 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_CloudAppEvents_Updated.yaml x: 7 contributors (90d) y: 4 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml x: 2 contributors (90d) y: 78 lines of code Solutions/CiscoASA/Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml x: 2 contributors (90d) y: 39 lines of code DataConnectors/AWS-S3/Utils/CommonAwsPolicies.ps1 x: 15 contributors (90d) y: 224 lines of code Solutions/AtlassianConfluenceAudit/Parsers/ConfluenceAudit.yaml x: 6 contributors (90d) y: 76 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAgentPoolCreatedDeleted.yaml x: 5 contributors (90d) y: 57 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOAuditStreamDisabled.yaml x: 5 contributors (90d) y: 37 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/ADOSecretNotSecured.yaml x: 5 contributors (90d) y: 44 lines of code Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml x: 5 contributors (90d) y: 72 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml x: 5 contributors (90d) y: 27 lines of code Solutions/AzureDevOpsAuditing/Hunting Queries/ADONewAgentPoolCreated.yaml x: 5 contributors (90d) y: 6 lines of code Solutions/ImpervaCloudWAF/Data Connectors/ImpervaWAFCloudSentinelConnector/__init__.py x: 7 contributors (90d) y: 221 lines of code Solutions/Microsoft Entra ID/Analytic Rules/AnomalousUserAppSigninLocationIncrease-detection.yaml x: 6 contributors (90d) y: 38 lines of code Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml x: 6 contributors (90d) y: 91 lines of code Solutions/QualysVM/Data Connectors/AzureFunctionQualysVM_V2/run.ps1 x: 4 contributors (90d) y: 285 lines of code Solutions/QualysVM/Parsers/QualysHostDetection.yaml x: 4 contributors (90d) y: 88 lines of code Solutions/SAP ETD Cloud/Analytic Rules/SAPETD-LoginFromUnexpectedNetwork.yaml x: 19 contributors (90d) y: 65 lines of code Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxApplicationPrivilegeEscalationOrChange.yaml x: 12 contributors (90d) y: 30 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_EvidenceOfMimikatzDCShadowAttack.yaml x: 11 contributors (90d) y: 23 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_KerberoskrbtgtAccount.yaml x: 11 contributors (90d) y: 32 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Failed_Logons.yaml x: 11 contributors (90d) y: 53 lines of code Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_RBAC_Changes.yaml x: 11 contributors (90d) y: 61 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_CommonSecurityLog.yaml x: 6 contributors (90d) y: 50 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_EmailUrlInfo_Updated.yaml x: 6 contributors (90d) y: 66 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/DomainEntity_PaloAlto.yaml x: 6 contributors (90d) y: 108 lines of code Solutions/Threat Intelligence (NEW)/Analytic Rules/IPEntity_imNetworkSession.yaml x: 7 contributors (90d) y: 106 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/message_factory.py x: 8 contributors (90d) y: 526 lines of code Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/withsecure_client.py x: 8 contributors (90d) y: 146 lines of code Tools/Create-Azure-Sentinel-Solution/common/commonFunctions.ps1 x: 19 contributors (90d) y: 3350 lines of code Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1 x: 18 contributors (90d) y: 921 lines of code DataConnectors/AWS-S3/ConfigCloudTrailDataConnector.ps1 x: 11 contributors (90d) y: 299 lines of code DataConnectors/AWS-S3/ConfigCloudWatchDataConnector.ps1 x: 11 contributors (90d) y: 97 lines of code DataConnectors/AWS-S3/ConfigGuardDutyDataConnector.ps1 x: 11 contributors (90d) y: 270 lines of code DataConnectors/AWS-S3/Utils/AwsPoliciesUpdate.ps1 x: 11 contributors (90d) y: 125 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCDNLogsSetup/GCPCDNLogSetup.tf x: 9 contributors (90d) y: 86 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPCloudIDSLogSetup/GCPCloudIDSLogSetup.tf x: 8 contributors (90d) y: 86 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPDNS_CCPLogsSetup/GCPDNSLogSetup.tf x: 13 contributors (90d) y: 82 lines of code DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPIAMCCPLogsSetup/GCPIAMLOGS.tf x: 12 contributors (90d) y: 82 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Email sender IP address Geo location information.yaml x: 13 contributors (90d) y: 20 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml x: 13 contributors (90d) y: 30 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Hunting/Email bombing.yaml x: 13 contributors (90d) y: 12 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Phish/Possible device code phishing attempts.yaml x: 13 contributors (90d) y: 47 lines of code Playbooks/Isolate-AzVM/Convert-SnapshotsToVHD.ps1 x: 7 contributors (90d) y: 195 lines of code Playbooks/Isolate-AzVM/Set-ManagedIdentity.ps1 x: 7 contributors (90d) y: 92 lines of code Solutions/AIShield AI Security Monitoring/Analytic Rules/BIIDetectionVulDetection.yaml x: 14 contributors (90d) y: 41 lines of code Solutions/AIShield AI Security Monitoring/Parsers/Guardian.yaml x: 14 contributors (90d) y: 27 lines of code Solutions/Armis/Data Connectors/ArmisDevice/ArmisDeviceSentinelConnector/__init__.py x: 13 contributors (90d) y: 456 lines of code Solutions/AtlassianConfluenceAudit/Data Connectors/AtlassianConfluenceAuditDataConnector/ConfluenceAuditAPISentinelConnector/__init__.py x: 9 contributors (90d) y: 115 lines of code Solutions/AtlassianConfluenceAudit/Data Connectors/AtlassianConfluenceAuditDataConnector/ConfluenceAuditAPISentinelConnector/state_manager.py x: 9 contributors (90d) y: 18 lines of code Solutions/Commvault Security IQ/Data Connectors/AzureFunctionCommvaultSecurityIQ/main.py x: 13 contributors (90d) y: 467 lines of code Solutions/Commvault Security IQ/Tools/AssignLogicAppRoles.ps1 x: 9 contributors (90d) y: 67 lines of code Solutions/Commvault Security IQ/Tools/Setup-CommvaultAutomation.ps1 x: 9 contributors (90d) y: 222 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_disk.yaml x: 7 contributors (90d) y: 968 lines of code Solutions/Corelight/Parsers/corelight_corelight_metrics_iface.yaml x: 7 contributors (90d) y: 164 lines of code Solutions/Corelight/Parsers/corelight_files.yaml x: 8 contributors (90d) y: 137 lines of code Solutions/Corelight/Parsers/corelight_http.yaml x: 8 contributors (90d) y: 205 lines of code Solutions/Corelight/Parsers/corelight_notice.yaml x: 7 contributors (90d) y: 146 lines of code Solutions/Corelight/Parsers/corelight_smb_files.yaml x: 7 contributors (90d) y: 125 lines of code Solutions/Corelight/Parsers/corelight_smtp.yaml x: 7 contributors (90d) y: 129 lines of code Solutions/Corelight/Parsers/corelight_suricata_corelight.yaml x: 7 contributors (90d) y: 207 lines of code Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml x: 10 contributors (90d) y: 64 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopDetectionsOrchestrator/__init__.py x: 9 contributors (90d) y: 11 lines of code Solutions/ExtraHop/Data Connectors/ExtraHopDataConnector/ExtraHopSentinelActivity/sentinel.py x: 9 contributors (90d) y: 197 lines of code Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml x: 10 contributors (90d) y: 35 lines of code Solutions/Google Apigee/Parsers/ApigeeXV2.yaml x: 10 contributors (90d) y: 43 lines of code Solutions/Google Apigee/Parsers/Unified_ApigeeX.yaml x: 10 contributors (90d) y: 82 lines of code Solutions/GoogleCloudPlatformDNS/Parsers/GCPCloudDNS.yaml x: 13 contributors (90d) y: 131 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectAlerts.yaml x: 4 contributors (90d) y: 81 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml x: 4 contributors (90d) y: 4 lines of code Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml x: 4 contributors (90d) y: 52 lines of code Solutions/Jamf Protect/Parsers/JamfProtectAlerts.yaml x: 4 contributors (90d) y: 20 lines of code Solutions/Jamf Protect/Parsers/JamfProtectNetworkTraffic.yaml x: 4 contributors (90d) y: 61 lines of code Solutions/Jamf Protect/Parsers/JamfProtectTelemetry.yaml x: 4 contributors (90d) y: 740 lines of code Solutions/Microsoft Entra ID/Analytic Rules/SuspiciousServicePrincipalcreationactivity.yaml x: 12 contributors (90d) y: 97 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/CollectExchSecIns.ps1 x: 14 contributors (90d) y: 3543 lines of code Solutions/Microsoft Exchange Security - Exchange On-Premises/Parsers/ExchangeAdminAuditLogs.yaml x: 14 contributors (90d) y: 65 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/configurations.py x: 13 contributors (90d) y: 117 lines of code Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/timer_trigger/__init__.py x: 13 contributors (90d) y: 104 lines of code DataConnectors/Syslog/Forwarder_AMA_installer.py x: 11 contributors (90d) y: 248 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/main.py x: 10 contributors (90d) y: 147 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/models.py x: 10 contributors (90d) y: 86 lines of code Solutions/ESET Protect Platform/Data Connectors/integration/utils.py x: 10 contributors (90d) y: 276 lines of code Solutions/IPinfo/Data Connectors/RIRWHOIS/AzureFunctionIPinfoRIRWHOIS/constants.py x: 10 contributors (90d) y: 99 lines of code Solutions/Proofpoint On demand(POD) Email Security/Data Connectors/ProofpointSentinelConnector/__init__.py x: 10 contributors (90d) y: 165 lines of code Detections/MultipleDataSources/AnomalousIPUsageFollowedByTeamsAction.yaml x: 3 contributors (90d) y: 128 lines of code Hunting Queries/AzureStorage/AzureStorageFileCreatedQuicklyDeleted.yaml x: 8 contributors (90d) y: 39 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Attachment/ATP policy status check.yaml x: 3 contributors (90d) y: 27 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/Audit Email Preview-Download action.yaml x: 3 contributors (90d) y: 29 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/General/MDO daily detection summary report.yaml x: 3 contributors (90d) y: 65 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/Mailflow/Detections by detection methods.yaml x: 3 contributors (90d) y: 46 lines of code Hunting Queries/Microsoft 365 Defender/Email Queries/URL/Phishing Email Url Redirector.yaml x: 3 contributors (90d) y: 6 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventNative.yaml x: 4 contributors (90d) y: 103 lines of code Parsers/ASimAuthentication/Parsers/imAuthentication.yaml x: 4 contributors (90d) y: 115 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionCiscoASA.yaml x: 4 contributors (90d) y: 461 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionCiscoASA.yaml x: 4 contributors (90d) y: 590 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async.py x: 4 contributors (90d) y: 193 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/soar_connector_async_v2.py x: 4 contributors (90d) y: 230 lines of code Solutions/AbnormalSecurity/Data Connectors/SentinelFunctionsOrchestrator/utils.py x: 4 contributors (90d) y: 135 lines of code Solutions/BloodHound Enterprise/Data Connectors/handler.go x: 3 contributors (90d) y: 172 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/bloodhound/client.go x: 3 contributors (90d) y: 200 lines of code Solutions/BloodHound Enterprise/Data Connectors/pkg/connector/main.go x: 3 contributors (90d) y: 597 lines of code Solutions/CyberArkAudit/Data Connectors/CyberArkAuditConnector/audit.py x: 3 contributors (90d) y: 165 lines of code Solutions/CyberArkEPM/DataConnectors/CyberArkEPMSentinelConnector/__init__.py x: 4 contributors (90d) y: 160 lines of code Solutions/Dragos/Parsers/DragosPullNotificationsToSentinel.yaml x: 9 contributors (90d) y: 46 lines of code Solutions/Dragos/Parsers/DragosPushNotificationsToSentinel.yaml x: 4 contributors (90d) y: 41 lines of code Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml x: 9 contributors (90d) y: 41 lines of code Solutions/IllumioSaaS/Data Connectors/TimedApiFunctionApp/api_response.py x: 9 contributors (90d) y: 179 lines of code Solutions/Microsoft Defender XDR/Analytic Rules/Persistence/LocalAdminGroupChanges.yaml x: 3 contributors (90d) y: 83 lines of code Solutions/Microsoft Entra ID/Analytic Rules/MFARejectedbyUser.yaml x: 3 contributors (90d) y: 85 lines of code Solutions/Salesforce Service Cloud/Data Connectors/SalesforceSentinelConnector/__init__.py x: 3 contributors (90d) y: 239 lines of code Solutions/SentinelOne/Parsers/SentinelOne.yaml x: 3 contributors (90d) y: 651 lines of code Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 x: 8 contributors (90d) y: 292 lines of code Tools/Create-Azure-Sentinel-Solution/common/get-ccp-details.ps1 x: 8 contributors (90d) y: 362 lines of code Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1 x: 8 contributors (90d) y: 106 lines of code ASIM/dev/ASimYaml2ARM/KqlFuncYaml2Arm.py x: 1 contributors (90d) y: 219 lines of code ASIM/dev/Parser YAML templates/ASimAlertEventTemplate.yaml x: 1 contributors (90d) y: 30 lines of code ASIM/dev/Parser YAML templates/vimAlertEventTemplate.yaml x: 1 contributors (90d) y: 82 lines of code ASIM/dev/Parser YAML templates/vimAuthenticationTemplate.yaml x: 1 contributors (90d) y: 95 lines of code ASIM/dev/Parser YAML templates/vimDhcpEventTemplate.yaml x: 1 contributors (90d) y: 62 lines of code ASIM/lib/functions/ASIM_FillNull.yaml x: 1 contributors (90d) y: 26 lines of code DataConnectors/AWS-S3/CloudWatchLambdaFunction.py x: 1 contributors (90d) y: 47 lines of code DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion/__init__.py x: 1 contributors (90d) y: 334 lines of code DataConnectors/O365 Data/O365APItoAS-Template/TimerTrigger/run.ps1 x: 1 contributors (90d) y: 276 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashEventsBatcher.rb x: 2 contributors (90d) y: 115 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/version.rb x: 2 contributors (90d) y: 9 lines of code DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec x: 2 contributors (90d) y: 19 lines of code Detections/CommonSecurityLog/MultiVendor-PossibleDGAContacts.yaml x: 1 contributors (90d) y: 132 lines of code Detections/SecurityAlert/AVSpringShell.yaml x: 1 contributors (90d) y: 5 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventMicrosoftDefenderXDR.yaml x: 1 contributors (90d) y: 174 lines of code Parsers/ASimAlertEvent/Parsers/ASimAlertEventSentinelOneSingularity.yaml x: 1 contributors (90d) y: 113 lines of code Parsers/ASimAlertEvent/Parsers/vimAlertEventMicrosoftDefenderXDR.yaml x: 1 contributors (90d) y: 228 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventIllumioSaaSCore.yaml x: 1 contributors (90d) y: 375 lines of code Parsers/ASimAuditEvent/Parsers/ASimAuditEventInfobloxBloxOne.yaml x: 1 contributors (90d) y: 143 lines of code Parsers/ASimAuditEvent/Parsers/vimAuditEventIllumioSaaSCore.yaml x: 1 contributors (90d) y: 434 lines of code Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml x: 1 contributors (90d) y: 396 lines of code Parsers/ASimDns/Parsers/vimDnsInfobloxBloxOne.yaml x: 1 contributors (90d) y: 285 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSession.yaml x: 1 contributors (90d) y: 103 lines of code Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionIllumioSaaSCore.yaml x: 1 contributors (90d) y: 306 lines of code Parsers/ASimNetworkSession/Parsers/vimNetworkSessionIllumioSaaSCore.yaml x: 1 contributors (90d) y: 385 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/__init__.py x: 1 contributors (90d) y: 340 lines of code Solutions/Armis/Data Connectors/ArmisAlertsActivities/ArmisAlertActivitySentinelConnector/utils.py x: 1 contributors (90d) y: 205 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/AlertsGraphStatisticsDetails/bitsight_statistics.py x: 1 contributors (90d) y: 473 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/BreachesDetails/bitsight_breaches.py x: 1 contributors (90d) y: 189 lines of code Solutions/BitSight/Data Connectors/BitSightDataConnector/CompaniesDetails/bitsight_companies.py x: 1 contributors (90d) y: 248 lines of code Solutions/Box/Parsers/BoxEvents.yaml x: 2 contributors (90d) y: 320 lines of code Solutions/Cloudflare/Data Connectors/AzureFunctionCloudflare/main.py x: 1 contributors (90d) y: 160 lines of code Solutions/Microsoft Business Applications/Parsers/MSBizAppsOrgSettings.yaml x: 1 contributors (90d) y: 478 lines of code Solutions/Mimecast/Data Connectors/MimecastAT/SharedCode/utils.py x: 1 contributors (90d) y: 751 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/sentinel.py x: 1 contributors (90d) y: 256 lines of code Solutions/Mimecast/Data Connectors/MimecastAudit/SharedCode/utils.py x: 1 contributors (90d) y: 565 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/MimecastCI/mimecast_ci_to_sentinel.py x: 1 contributors (90d) y: 553 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/sentinel.py x: 1 contributors (90d) y: 318 lines of code Solutions/Mimecast/Data Connectors/MimecastCloudIntegrated/SharedCode/utils.py x: 1 contributors (90d) y: 628 lines of code Solutions/Mimecast/Data Connectors/MimecastSEG/SharedCode/utils.py x: 1 contributors (90d) y: 625 lines of code Solutions/Mimecast/Data Connectors/MimecastTTP/SharedCode/utils.py x: 1 contributors (90d) y: 733 lines of code Solutions/Tomcat/Analytic Rules/TomcatPutAndGetFileFromSameIP.yaml x: 2 contributors (90d) y: 44 lines of code
3543.0
lines of code
  min: 1.0
  average: 77.05
  25th percentile: 30.0
  median: 41.0
  75th percentile: 74.75
  max: 3543.0
0 19.0
contributors (90d)
min: 1.0 | average: 3.81 | 25th percentile: 1.0 | median: 3.0 | 75th percentile: 5.0 | max: 19.0