5 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
This GitHub repository offers a collection of resources for Microsoft Sentinel and Microsoft 365 Defender, including detections, queries, playbooks, and workbooks. Users can contribute and seek help while ensuring compliance with contribution guidelines and validation checks.
If you do, here's more
The Azure Sentinel repository on GitHub provides a comprehensive set of resources for users looking to enhance their security capabilities. It includes out-of-the-box detections, exploration and hunting queries, playbooks, and workbooks specifically designed for Microsoft Sentinel and Microsoft 365 Defender. Users can submit issues for additional resources they wish to see, making it an interactive platform for onboarding and enhancing security measures.
Contributors can add to the repository following specific guidelines, which require agreement to a Contributor License Agreement (CLA). New contributors should follow instructions for forking and cloning the repository, creating branches, and submitting pull requests (PRs). Importantly, PRs undergo validation checks for YAML structure and KQL syntax. Missing or incorrect elements can lead to validation errors, which are clearly outlined in error messages.
To ensure submissions are correct, users can run KQL validations locally using the .NET Core SDK. This involves executing tests that check for proper schema and syntax before submitting changes. The validation process also includes checks for detection frequency, trigger types, and the validity of connector IDs. This structured approach helps maintain high standards for contributions and ensures that all added content functions correctly within the Azure Sentinel framework.
Questions about this article
No questions yet.