display_name: KQL
description: A feed to pull in everything Microsoft KQL related (v.01)
  
  Feed config:
  https://github.com/AttacktheSOC/bluesky-files/blob/main/KQL-feed.json
  Microsoft Defender for Endpoint Sentinel Advanced Hunting
additional_fields: {"skyfeedBuilder":{"blocks":[{"id":"aaaboqqdviqsy","type":"input","inputType":"firehose","firehoseSeconds":604800},{"id":"aaaboqqdvkhdi","type":"remove","value":"reply","subject":"item"},{"id":"aaaboqqdvjbts","type":"regex","value":"(?i)\\b#?KQL\\b|\\b(DeviceProcessEvents|IdentityInfo|DeviceLogonEvents|SecurityEvent|AzureActivity|AuditLogs|SigninLogs|ProcessEvents|UserSignins|LogManagement|DeviceNetworkEvents|DeviceFileEvents|DeviceRegistryEvents|DeviceImageLoadEvents|DeviceEvents|AlertInfo|AlertEvidence|IdentityLogonEvents|EmailEvents|EmailPostDeliveryEvents|EmailUrlInfo|EmailAttachmentInfo|FileCreationEvents|NetworkSessionEvents)\\b","caseSensitive":false},{"id":"aaaborjl4h33c","type":"remove","value":"repost","subject":"item"},{"id":"aaaboqqdvjvp4","type":"sort","sortType":"created_at"}],"license":"MIT","displayName":"KQL"}}