kql-mde-xdr

What problem does it solve?

KQL queries for Microsoft Defender for Endpoint (MDE), Microsoft Sentinel, and Defender for Microsoft 365 Defender XDR are often complex, error-prone, and slow to write, making threat hunting and incident investigations tedious and error-prone.

Core Features & Use Cases

• Write and optimize KQL queries across MDE, Sentinel, and M365 Defender XDR to improve detection analytics.
• Validate field schemas and reference tables from the references directory before constructing queries to ensure accuracy.
• Use cases include threat hunting, detection engineering, and incident investigations across Defender products, with guidance for performance and readability.

Quick Start

Craft a minimal KQL query against DeviceInfo to validate schema and syntax, then run it to confirm results.